OS Command Injection Vulnerability in AhsayCBS by Ahsay Systems
CVE-2026-105134

10CRITICAL

Key Information:

Vendor

Ahsay

Status
Ahsaycbs
Vendor
CVE Published:
4 October 2026

What is CVE-2026-105134?

A vulnerability has been identified in Ahsay AhsayCBS affecting versions prior to 10.3.2. This issue arises from a weakness in the /rps/api/json/UpdateReceivers.do file within the Replication Receiver component. An attacker can exploit this vulnerability by manipulating the 'random' argument, allowing for the execution of arbitrary operating system commands. The potential for remote exploitation poses a significant risk. Users are strongly encouraged to update to version 10.3.4 to close this security gap.

Affected Version(s)

AhsayCBS 10.3.0

AhsayCBS 10.3.1

AhsayCBS 10.3.2

References

https://vuldb.com/vuln/413351
vdb-entrytechnical-description
https://vuldb.com/vuln/413351/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105134
third-party-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nickc (VulDB User)
VulDB Vulnerability Moderation Team
.