ZeroDayAlert

CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

Ahsay AhsayCBS Added to KEV 2026-10-14 Federal due 2026-10-17 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Ahsay AhsayCBS is affected by this command injection vulnerability in its Replication Receiver component. The vulnerability is exposed through the /rps/api/json/UpdateReceivers.do endpoint and can be triggered by manipulation of the random parameter. The record does not specify which versions of AhsayCBS are vulnerable, nor does it detail whether on-premises deployments, cloud-hosted instances, or both are in scope.

How to check whether this touches you

  • Inventory all instances of Ahsay AhsayCBS in your environment, including both on-premises and cloud-hosted deployments.
  • Verify whether the Replication Receiver component is enabled and whether the /rps/api/json/UpdateReceivers.do endpoint is reachable from untrusted networks (including the internet).
  • Check the running version of AhsayCBS by consulting the application's administration console or version information in logs; note that version numbers alone do not confirm the presence or absence of a backported fix.
  • If the product is cloud-hosted, establish whether your service provider has applied mitigations and request written confirmation.

What to do

  1. Contact Ahsay support immediately to obtain vendor-specific patch or mitigation guidance, since no patch version is specified in this advisory.
  2. If you cannot patch immediately, restrict network access to the /rps/api/json/UpdateReceivers.do endpoint using a firewall or reverse proxy; allow only trusted source IP addresses.
  3. Enable and retain detailed access and error logs from the Replication Receiver component, particularly requests to UpdateReceivers.do and any associated command execution logs, for at least 90 days.
  4. If the product is cloud-hosted and the vendor cannot confirm mitigations are in place, escalate to your service provider's security team and document their response timeline; prepare a discontinuation plan if mitigations remain unavailable beyond your organisation's risk tolerance.

If you find you were exposed

Exploitation of command injection vulnerabilities typically occurs before public disclosure, so treat the CVE publication date as a backward-looking reference point, not the start of your exposure window. Request logs covering at least the previous three months from the Replication Receiver component and examine them for anomalous requests to the UpdateReceivers.do endpoint, unusual parameter values, or evidence of command execution. If log retention is insufficient, work with your infrastructure and security teams to determine whether system-level audit logs, network flow data, or endpoint detection logs can fill the gap.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-105134 is being exploited. It cannot tell you whether AhsayCBS is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →