AhsayCBS - RCE (CVE-2026-105134)
Description
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
psychologyCrowdSec Analysis
CVE-2026-105134 is a critical remote OS command injection vulnerability in AhsayCBS’s Replication Receiver, exploitable by manipulating the random argument at /rps/api/json/UpdateReceivers.do. The flaw can allow unauthenticated attackers to execute commands and compromise affected systems; exploitation has been publicly reported. Upgrade to AhsayCBS 9.15.2.70 or 10.3.4.45 to address the vulnerability.
CrowdSec has been tracking this vulnerability and its exploits since 27th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-105134 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target /rps/api/json/UpdateReceivers.do to create a replication receiver, then exploit /rps/obs7/rpsfile/upload with traversal paths to place a JSP webshell under /rps. They may then access /rps/<shell>.jsp with command parameters to execute commands on the server.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-10-04 |
| CISA KEV | 2026-10-14 |
| CISA Remediation Deadline | 2026-10-17 |
| Rule Released | 2026-10-27 |
| CrowdSec First Seen | 2026-10-29 |
Related Weaknesses
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.