Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
Executive & SecOps Summary
SECOPS ASSESSMENTAhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Unauthenticated remote attackers can execute arbitrary OS commands by manipulating API arguments, leading to full system compromise
Immediately upgrade to version 9.15.2.70 or 10.3.4.45 or later
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Immediate Upgrade: Apply the latest security patches: v9.15.2.70 or v10.3.4.45.
- WAF Implementation: Deploy WAF rules to filter suspicious characters (e.g.,
;,|,&,$()) in requests directed to/rps/api/json/UpdateReceivers.do. - Network Segmentation: Restrict access to the Replication Receiver API to known, trusted IP addresses only.
- Incident Response: Check system logs for unusual process executions originating from the web server user.
Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
The vulnerability exists in the /rps/api/json/UpdateReceivers.do endpoint of the AhsayCBS Replication Receiver. An unauthenticated attacker can inject OS commands via the random parameter. Due to improper input validation (CWE-77/78), the system executes these commands with the privileges of the application service. This flaw has a CVSS score of 10.0 and is listed in the CISA KEV catalog, indicating active exploitation in the wild. Notably, the initial vendor patch was found to be incomplete, requiring a subsequent update to fully remediate the issue.
Official Vendor Advisories & References
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.