CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability

VulDB, which assigned the CVE, says the flaw affects "the argument random"[2] and can be exploited remotely[2]. According to Threat Radar, it sits in the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver[3]. Strix reports that the CVE has a CVSS score of 10/10 (CRITICAL severity)[4].The CVE record lists versions up to 10.3.2[3] as affected and says upgrading to version 10.3.4 is able to resolve this issue[3].Windows Forum reports that, according to Huntress's updated advisory, AhsayCBS 10.3.4 is affected, despite earlier reporting suggesting it was not susceptible[5].Windows Forum also says Huntress began seeing threat actors exploiting the flaws[5] on October 7 and had seen five organizations targeted[5] by October 8.Innovation Network Design reports that attackers are planting web shells and install an XMRig miner disguised as Microsoft Edge[6].Rescana reports that Ahsay says its earlier update "did not fully address"[1] the two flaws, and it names AhsayCBS hotfix v10.3.4.45[1] as the fix. Rescana adds that it found no independent confirmation that v10.3.4.45 fully fixes the flaws[1].Windows Forum reports that Huntress advises admins to restrict console access and check for webshells and miners pending a confirmed fix[5].