CVE-2026-105134
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
CVSS Score
10.0
EPSS Score
1.8%
EPSS Percentile
79th
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
| CWE | CWE-78 CWE-77 |
| Vendor | ahsay |
| Product | ahsaycbs |
| Published | Oct 4, 2026 |
| Last Updated | Oct 15, 2026 |
⚠️ Actively Exploited — Act Now
Get instant alerts for ahsay ahsaycbs
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2026-105134.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Ahsay / AhsayCBS
10.3.0 10.3.1 10.3.2
References
vuldb.com: https://vuldb.com/vuln/413351 vuldb.com: https://vuldb.com/vuln/413351/cti vuldb.com: https://vuldb.com/cve/CVE-2026-105134 vuldb.com: https://vuldb.com/submit/942743 ahsay.com: https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4 cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134
Credits
🔍 nickc (VulDB User) VulDB Vulnerability Moderation Team