Patch Forecast
Red warning
Act within 24 hours. CISA deadline for US federal agencies: 17 Oct 2026.

CVE-2026-105134 Exploited in the wild

Ahsay AhsayCBS Command Injection Vulnerability

Risk score
100/100
CVSS
10.0 v3.1
Exploit chance (30 days)
38.3%
Published
4 Oct 2026
Added to CISA's exploited list
14 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Ahsay AhsayCBS has a command injection vulnerability in the /rps/api/json/UpdateReceivers.do component, allowing remote attackers to inject OS commands. This could lead to high impact, including full control of the system.
Affected
{'products': ['Ahsay AhsayCBS'], 'packages': [], 'versions': ['up to 10.3.2']}
Fix
Upgrade to version 10.3.4
Exploitation
Exploited in the wild

Story map

Story map: AhsaycbsTHE FLAWSTHE FIXCVE-2026-105134Ahsay AhsayCBS CommandInjection VulnerabilityCVSS 10.0 · EPSS 38% · exploitedCVE-2026-105133Ahsay AhsayCBS ImproperAuthentication VulnerabilityCVSS 7.3 · EPSS 6% · exploitedFixUpgrade to version 10.3.4Who is exposed{'products': ['Ahsay AhsayCBS'],'packages': [], 'versions': ['up to10.3.2']}RED · ACT TODAYAhsaycbsAhsay AhsayCBS has a commandinjection vulnerability in the/rps/api/json/UpdateReceivers.do component, allowing remoteattackers to inject OScommands. This could lead tohigh impact, including full…Where it standsExploited in the wildOn CISA's exploited list since 14 OctUS federal deadline 17 OctHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.14 Oct · CISAAdded to the Known Exploited Vulnerabilities list (2of these flaws)17 Oct · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessCommand injection (CWE-77)97 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Ahsaycbs: Red, act today. Ahsay AhsayCBS has a command injection vulnerability in the /rps/api/json/UpdateReceivers.do component, allowing remote attackers to inject OS commands. This could lead to high impact, including full control of the system.

The flaws

  • CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability (CVSS 10.0 · EPSS 38% · exploited)
  • CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability (CVSS 7.3 · EPSS 6% · exploited)

The fix

Fix: Upgrade to version 10.3.4

Who is exposed: {'products': ['Ahsay AhsayCBS'], 'packages': [], 'versions': ['up to 10.3.2']}

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 14 Oct
  • US federal deadline 17 Oct

How it unfolded

  1. 14 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list (2 of these flaws)
  2. 17 Oct, Deadline (official): US federal agencies must have patched

Connects to

Why it is Red

  • CVSS 10.0 critical
  • Exploitation likely: EPSS 38.3% (top 1%)
  • Exploited in the wild (CISA KEV)
  • Remotely exploitable without logging in

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

Original description

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

Last activity 14 Oct 2026. Patch Forecast updates every hour.