CVE-2026-105134: OS Command Injection in Ahsay AhsayCBS
Description
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
CVSS v4.0
Score 10.0critical
Affected software
Ahsay
AhsayCBS
cpe:2.3:a:ahsay:ahsaycbs:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Ahsay AhsayCBS up to version 10.3.2 contains an OS command injection vulnerability in the Replication Receiver component, specifically in the /rps/api/json/UpdateReceivers.do file. An attacker can remotely manipulate the 'random' argument to execute arbitrary operating system commands. This vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity. Exploit code is publicly available. The vendor has released version 10.3.4 which fixes this vulnerability.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system without any privileges or user interaction, potentially leading to full system compromise. The vulnerability is remotely exploitable and has a critical CVSS score of 10.0.
Mitigation Recommendations
Upgrade affected AhsayCBS installations from versions 10.3.0, 10.3.1, or 10.3.2 to version 10.3.4 or later to remediate this vulnerability. This is the official fix provided by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-03T13:13:35.953Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac1f64ea43b0b3b89434769
Added to database: 10/04/2026, 06:46:38 UTC
Last enriched: 10/04/2026, 07:01:08 UTC
Last updated: 10/04/2026, 09:37:36 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.