Vulnerability details
CVE-2026-105134
Actively exploited
Ahsay AhsayCBS
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
CVSS 4.0
10.0Critical
Official description
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
Related news
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 10.0Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A |
| 10.0Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C |
| 10.0Critical | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C |
| 10.0High | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Ahsay | AhsayCBS | 10.3.4.0 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.1 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.10 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.11 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.12 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.13 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.14 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.15 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.16 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.17 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.18 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.19 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.2 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.20 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.21 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.22 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.23 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.24 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.25 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.26 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.27 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.28 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.29 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.3 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.30 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.31 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.32 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.33 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.34 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.35 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.36 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.37 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.38 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.39 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.4 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.40 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.41 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.42 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.43 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.44 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.5 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.6 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.7 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.8 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 10.3.4.9 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.0 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.1 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.10 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.11 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.12 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.13 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.14 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.15 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.16 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.17 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.18 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.19 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.2 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.20 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.21 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.22 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.23 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.24 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.25 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.26 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.27 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.28 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.29 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.3 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.30 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.31 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.32 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.33 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.34 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.35 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.36 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.37 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.38 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.39 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.4 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.40 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.41 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.42 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.43 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.44 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.45 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.46 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.47 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.48 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.49 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.5 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.50 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.51 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.52 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.53 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.54 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.55 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.56 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.57 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.58 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.59 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.6 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.60 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.61 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.62 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.63 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.64 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.65 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.66 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.67 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.68 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.69 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.7 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.8 | CVEProject cvelistV5 (CNA) |
| Ahsay | AhsayCBS | 9.15.2.9 | CVEProject cvelistV5 (CNA) |
References and advisories
7- https://vuldb.com/vuln/413351 vdb-entrytechnical-description
- https://vuldb.com/vuln/413351/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-105134 third-party-advisory
- https://vuldb.com/submit/942743 third-party-advisory
- https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update patch
- https://www.huntress.com/blog/ahsaycbs-flaws-exploit broken-linkexploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134 government-resource
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-04
- Last updated
- 2026-10-26
- State
- Published
- Assigner (CNA)
- VulDB
- Kolun priority
- 90 · Critical
CISA KEV catalog
- Date added
- 2026-10-14
- Due date
- 2026-10-17
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
81.76%
Probability of exploitation in 30 days
99.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78OS Command Injection
- CWE-77Command Injection