CVE-2026-105134
Received Received - Intake

AhsayCBS Remote Command Injection via Replication Receiver

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulDB

Description
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-105134
EUVD
EUVD-2026-92078

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ahsay ahsaycbs to 10.3.2 (inc)
ahsay ahsaycbs 10.3.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in Ahsay AhsayCBS versions up to 10.3.2. It exists in the file /rps/api/json/UpdateReceivers.do within the Replication Receiver component. Attackers can manipulate the 'random' argument to inject and execute arbitrary OS commands remotely. A public exploit is available, and upgrading to version 10.3.4 fixes the issue.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. The vulnerability involves OS command injection via the /rps/api/json/UpdateReceivers.do endpoint in AhsayCBS versions up to 10.3.2. Monitoring network traffic for unusual requests to this endpoint or inspecting logs for suspicious command execution attempts may help detect exploitation attempts.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the affected system with high privileges. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. Systems running vulnerable versions of AhsayCBS are at risk if exposed to untrusted networks.

Compliance Impact

The vulnerability allows remote command injection via manipulation of the 'random' argument in AhsayCBS up to 10.3.2. This could lead to unauthorized data access, modification, or exfiltration, which may violate GDPR (data protection) and HIPAA (health data confidentiality) requirements for secure data handling and access controls.

Mitigation Strategies

Upgrade AhsayCBS to version 10.3.4 or later to resolve the vulnerability. Ensure the affected component Replication Receiver is updated immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105134. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart