/Vulnerability Library

AhsayCBS <= 10.3.4 - Unauthenticated RCE

CVE-2026-105134
Early Release

Description

Ahsay AhsayCBS <= 10.3.2 contains a command injection caused by manipulation of the \"random\" argument in /rps/api/json/UpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request

Severity

Critical

CVSS Score

10

Affected Product

ahsaycbs

Published Date

October 27, 2026

Template Author

0x_akoko

CVE-2026-105134.yaml
10.0Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-105134
CWE ID:
cwe-22

References

https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/https://nvd.nist.gov/vuln/detail/CVE-2026-105134

Remediation Steps

Upgrade to version 10.3.4.