Protego field desk
PROTEGO
← CVE Lookup

CVE-2026-105134

CRITICALCVSS 4.0 · 10.0 · cna@vuldb.com

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

CISA KEV: known exploited

Added: 2026-10-14 · Due: 2026-10-17

Known ransomware use: Unknown

EPSS: 81.76% · Percentile: 99.6%

As of 2026-10-27

EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.

CWE: CWE-77, CWE-78 · Published: 2026-10-04T07:16:33.480 · Modified: 2026-10-26T18:06:57.930

Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.

All CVSS assessments
  • CVSS 4.0: 10 (CRITICAL) · cna@vuldb.com
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • CVSS 3.1: 10 (CRITICAL) · cna@vuldb.com
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • CVSS 2.0: 10 (HIGH) · cna@vuldb.com
    AV:N/AC:L/Au:N/C:C/I:C/A:C

References and fixes