CVE-2026-105134: Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ahsay AhsayCBS Replication Receiverto a version that resolves this vulnerability.Fixed in 10.3.4
Event History
Frequently Asked Questions
Which deployments are affected?
Ahsay AhsayCBS deployments up to version 10.3.2 are affected in the Replication Receiver component. The vulnerable endpoint is /rps/api/json/UpdateReceivers.do.
What does an attacker need to exploit this issue?
The attack can be launched remotely by manipulating the random argument supplied to the affected endpoint. No privileges or user interaction are indicated by the supplied severity vector.
Is public exploitation a concern?
Yes. An exploit has been published and may be used, so exposed affected systems should be treated as high priority.
What remediation is available?
Upgrade Ahsay AhsayCBS to version 10.3.4, which resolves the issue according to the provided information.