CVE-2026-105134

CriticalCVSS 10.0

Published: 04/10/2026(UTC)Translated: 04/10/2026(UTC)NVD NIST

Summary

An OS command injection vulnerability was found in AhsayCBS up to version 10.3.2 in the file /rps/api/json/UpdateReceivers.do. The attack can be launched remotely, and the exploit has been published. Upgrading to version 10.3.4 resolves the issue.

Risk Assessment

The organization is exposed to remote execution of system commands, which could lead to server takeover or data corruption.

Recommendation

It is recommended to upgrade AhsayCBS to version 10.3.4 or later as soon as possible, as it contains a fix for the vulnerability.

Other vulnerabilities in AhsayCBS

CVE-2026-105133High
A vulnerability was detected in AhsayCBS up to version 10.3.2 in the checkSysPwd function in ApiStructsAction.java. Manipulation of the argument random results in improper authentication. The attack can be launched remotely, and the exploit is public. Upgrading to version 10.3.4 mitigates the issue.

Original NVD description (English source)

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS