CISA lists AhsayCBS command injection in KEV (CVE-2026-105134)
Original title: CISA KEV: Ahsay AhsayCBS Command Injection Vulnerability — Ahsay AhsayCBS (CVE-2026-105134)
AhsayCBS through 10.3.2 allows remote OS command injection via UpdateReceivers.do; version 10.3.4 fixes it, with a federal due date of October 17.
CISA added CVE-2026-105134, an OS command-injection flaw in Ahsay AhsayCBS, to the Known Exploited Vulnerabilities catalog. Manipulating the random argument in /rps/api/json/UpdateReceivers.do, part of the Replication Receiver component, can inject operating-system commands. The issue affects versions up to 10.3.2 and is fixed in 10.3.4. A public exploit exists; ransomware use is listed as unknown.
Unconfirmed: The catalog says the published exploit may be used and lists ransomware campaign use as unknown.
- The vulnerable endpoint is /rps/api/json/UpdateReceivers.do.
- The injectable argument is named random.
- The attack can be launched remotely.
- CISA’s required-action date is October 17, 2026.
Impact: Remote OS command injection on AhsayCBS
| Product | Affected | Fixed in |
|---|---|---|
| AhsayCBS | up to 10.3.2 | 10.3.4 |
- 1.Upgrade AhsayCBS to version 10.3.4.
- 2.Apply vendor mitigations and meet BOD 26-04 by October 17, 2026.
- CVEs
- CVE-2026-105134
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105134 | Unauthenticated OS Command Injection in AhsayCBS | 10.0 | 82% | KEVPoC | KEV |
From the original article
1 min read at cisa.govA flaw has been found in Ahsay AhsayCBS up to 10. 3. 2.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.