CVE-2026-105134: listed in the CISA KEV catalog

CVE-2026-105134 · CVSS 10.0 CRITICAL · EPSS 3% · KEV 2026-10-14 · patch available

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

Is CVE-2026-105134 exploited?

• Listed in the CISA KEV catalog on 2026-10-14.
• Federal remediation due 2026-10-17.
• EPSS puts exploitation in the next 30 days at 3%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Ahsay · AhsayCBS · 10.3.0, 10.3.1, 10.3.2

Is there a patch?

• AhsayCBS 10.3.4

What PlainSec published about CVE-2026-105134

• CISA puts firewall, mail, and backup flaws on clock (2026-10-15)
• AhsayCBS flaws now drive web shells and miners (2026-10-02)

Primary sources

• NVD record
• CISA KEV catalog

KEV and EPSS are re-checked daily. Record last updated 2026-10-15.