CVE-2026-105134: presente nel catalogo CISA KEV

CVE-2026-105134 · CVSS 10.0 CRITICAL · EPSS 3% · KEV 2026-10-14 · patch disponibile

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

CVE-2026-105134 viene sfruttato?

• Inserito nel catalogo CISA KEV il 2026-10-14.
• Scadenza di remediation federale: 2026-10-17.
• EPSS stima la probabilità di sfruttamento nei prossimi 30 giorni al 3%.
• Codice di exploit pubblico: nessuno trovato nelle fonti monitorate.

Quali prodotti e versioni sono interessati?

• Ahsay · AhsayCBS · 10.3.0, 10.3.1, 10.3.2

Esiste una patch?

• AhsayCBS 10.3.4

Cosa ha pubblicato PlainSec su CVE-2026-105134

• CISA puts firewall, mail, and backup flaws on clock (2026-10-15)
• AhsayCBS flaws now drive web shells and miners (2026-10-02)

Fonti primarie

• NVD record
• CISA KEV catalog

KEV ed EPSS vengono ricontrollati ogni giorno. Scheda aggiornata il 2026-10-15.