Vulnerability Report

CVE-2026-105134

RCE CISA KEV Active

Title: AhsayCBS Replication Receiver OS Command Injection

RCE

Proof Of Concept

PoC Available for CVE-2026-105134

CWE Category CWE-77

Published Date Oct 04, 2026

Modified Date Oct 15, 2026

Exploit Status Available

Score 9.3 CVSS v4.0

Exploit Probability (EPSS)

86.27%

Vulnerability Summary

CVE-2026-105134: A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

Impacted Vendors

ahsay 1

Reference Links

https://vuldb.com/cve/CVE-2026-105134 https://vuldb.com/submit/942743 https://vuldb.com/vuln/413351 https://vuldb.com/vuln/413351/cti https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4

CVSS v4.0

Source Entity [email protected]

Severity CRITICAL

9.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

10.0

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity HIGH

10.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns