AhsayCBS Command Injection in Replication Receiver (CVE-2026-105134)

Catalog analysis: CISA added this entry on October 14, 2026. The entry reflects catalog information retrieved on October 15, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-105134 is a command injection vulnerability (CWE-77, CWE-78) affecting Ahsay AhsayCBS. The flaw exists within the Replication Receiver component, specifically at the /rps/api/json/UpdateReceivers.do endpoint. A remote attacker can execute operating system commands by manipulating the random parameter sent to this endpoint. This vulnerability is noted as chainable with CVE-2026-105133.

Exposure and applicability

This vulnerability applies to organizations deploying AhsayCBS where the Replication Receiver component is active and accessible. The primary exposure path is the /rps/api/json/UpdateReceivers.do endpoint. Assets with direct internet exposure to this endpoint are at higher risk, as the attack vector is remote. Because this flaw has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, it should be prioritized for immediate remediation.

Remediation priorities

Our analysis suggests the following prioritization for vulnerability management teams:

1. Asset Identification: Identify all instances of AhsayCBS and determine if the Replication Receiver component is deployed and reachable via the network.
2. Immediate Patching: Apply vendor-provided mitigations as detailed in the official Ahsay announcements. Given the KEV status, this should be treated as a high-priority update.
3. Exposure Reduction: If immediate patching is not feasible, restrict network access to the /rps/api/json/UpdateReceivers.do endpoint to trusted sources only to reduce the remote attack surface.
4. Chain Analysis: Since CVE-2026-105134 can be chained with CVE-2026-105133, defenders should verify the remediation status of both vulnerabilities simultaneously to ensure a complete fix.

How to validate remediation

Verifying that a patch was installed is not equivalent to verifying that the vulnerability is mitigated. To assure exposure reduction, defenders should:

• Endpoint Testing: Use authorized security testing tools to attempt requests to the /rps/api/json/UpdateReceivers.do endpoint using manipulated random parameters to confirm the injection path is closed.
• Configuration Audit: Verify that the Replication Receiver component is updated to a version where the vendor has explicitly addressed CVE-2026-105134.
• Network Validation: Confirm via firewall or load balancer logs that unauthorized external traffic is blocked from reaching the affected API endpoint.

Limits and open questions

It remains unknown whether this vulnerability is currently being leveraged by ransomware campaigns. While vendor mitigations are available, the effectiveness of these fixes depends on correct deployment across all distributed Replication Receiver instances. Residual risk persists if the product is used in a configuration where the API endpoint must remain open to untrusted networks for operational reasons.

Source and editorial note

CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability · Source date: October 14, 2026 · Retrieved October 15, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment