CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
Other sources
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
— MITRE
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ahsay AhsayCBSto a version that resolves this vulnerability.Fixed in 10.3.4 - Upgrade
Upgrade
Ahsay AhsayCBSto a version that resolves this vulnerability.Fixed in 9.15.2.70 - Upgrade
Upgrade
Ahsay AhsayCBSto a version that resolves this vulnerability.Fixed in 10.3.4.45 - Compensating control
Discontinue use of Ahsay AhsayCBS if mitigations are unavailable.
Event History
Frequently Asked Questions
Which deployments are affected?
Ahsay AhsayCBS deployments up to version 10.3.2 are affected in the Replication Receiver component. The vulnerable endpoint is /rps/api/json/UpdateReceivers.do.
What does an attacker need to exploit this issue?
The attack can be launched remotely by manipulating the random argument supplied to the affected endpoint. No privileges or user interaction are indicated by the supplied severity vector.
Is public exploitation a concern?
Yes. An exploit has been published and may be used, so exposed affected systems should be treated as high priority.
What remediation is available?
Upgrade Ahsay AhsayCBS to version 10.3.4, which resolves the issue according to the provided information.