No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Developments from the last 30 days, newest first.
CVE-2026-105134 scored CVSS 9.3
Basis: NIST National Vulnerability Database
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
Source reporting says attackers are already exploiting this, so exposed affected systems are at immediate risk.
Basis: Reporting by SecurityWeek
Source reporting says attackers are already exploiting this, so exposed affected systems are at immediate risk.
Treat this as an emergency.
