CISA added CVE-2026-105134 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The flaw affects Ahsay AhsayCBS and is a command injection vulnerability that could let a remote attacker execute operating system commands.
The vulnerability involves manipulation of the `random` parameter in the Replication Receiver component’s `/rps/api/json/UpdateReceivers.do` endpoint. It can be chained with CVE-2026-105133. The CVSS score is 10.0, rated Critical. A patch is available in AhsayCBS version 10.3.4; Ahsay has also published an advisory covering the issue.
The KEV listing confirms that the vulnerability is being actively exploited. Whether it has been used in ransomware campaigns is unknown. CISA’s remediation deadline is 17 October 2026.
CISA requires affected Federal Civilian Executive Branch (FCEB) agencies to apply mitigations in accordance with vendor instructions and applicable BOD 26-04 guidance, including its forensics triage requirements. Where mitigations are unavailable, agencies should discontinue use of the product. Stakeholders must assess each asset’s internet exposure and follow BOD 26-04 patching guidance. All organisations should review their exposure and apply the available update.
For full details, consult the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-105134) and [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).