CISA has confirmed active exploitation of CVE-2026-105134, an unauthenticated remote OS command injection flaw in the Replication Receiver component of Ahsay AhsayCBS, and federal agencies must act by October 17, 2026.
What Is It
CVE-2026-105134 is a command injection vulnerability (CWE-77, CWE-78) in Ahsay AhsayCBS. It sits in the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint. A remote attacker can manipulate the random parameter to run operating system commands on the host.
According to NVD, a public exploit exists and the attack can be launched remotely. CISA notes that this flaw can be chained with CVE-2026-105133.
Why It Matters
- Active exploitation confirmed: CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2026-10-14. CISA's SSVC assessment rates exploitation as active, automatable as yes, and technical impact as total.
- Maximum severity: The CVSS 3.1 base score is 10.0 (Critical), with vector
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That means it's reachable over the network with low complexity, and it needs no privileges or user interaction. The CVSS 4.0 score is 9.3 (Critical), with exploit maturity marked as proof-of-concept. - Forensic triage required: CISA flags this entry for its Forensics Triage Requirements. Patching alone may not be enough if a system was already exposed.
- Ransomware use: KEV lists known ransomware campaign use as "Unknown."
What's Vulnerable
- Vendor/Product: Ahsay AhsayCBS
- Component: Replication Receiver
- Confirmed affected: versions up to and including 10.3.2. Versions 10.3.0, 10.3.1 and 10.3.2 are listed by name.
- Confirmed fixed: 10.3.4
- Unclear: The public records cited here don't say whether 10.3.3 is affected. Treat any version below 10.3.4, including 10.3.3, as potentially vulnerable until Ahsay confirms otherwise.
The NVD record is still "Undergoing Analysis."
Patch Status
Ahsay has issued a fix. NVD states that upgrading to AhsayCBS 10.3.4 resolves the issue, and Ahsay has published a patch announcement covering CVE-2026-105133 and CVE-2026-105134. Since 10.3.4 is the only version confirmed as fixed, upgrade to 10.3.4 or later no matter which earlier version you run.
CISA required action (due 2026-10-17): Apply mitigations according to vendor instructions, in line with BOD 26-04 and CISA's Forensics Triage Requirements. For cloud services, follow the applicable BOD 26-04 guidance. If no mitigations are available, stop using the product. Stakeholders should check each asset's internet exposure and follow the BOD 26-04 patching guidelines.
Because this flaw can be chained with CVE-2026-105133 and is under active exploitation, apply the fix for both CVEs.
Sources
- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105134
- Ahsay Patch Announcement: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
- Ahsay AhsayCBS v10.3.4 Release Notes: https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage): https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- VulDB: https://vuldb.com/vuln/413351