Ahsay AhsayCBS: Command Injection Vulnerability
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Is it being exploited: yes. CISA added it to its list of actively exploited flaws on 14 October 2026.
Who is affected: anyone running Ahsay AhsayCBS. Check the vendor's advisory for the exact versions.
What to do: Apply mitigations in accordance with vendor instructions. CISA gave US federal agencies until 17 October 2026 to fix it.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.