Ahsay AhsayCBS Command Injection Vulnerability

What's happening and what to do

Attackers can run operating system commands on the server by tampering with a parameter in a web request, and this flaw is being actively exploited. Ahsay AhsayCBS. Apply the vendor's update now and check for signs of compromise.

AI summary of the sources on this page. Regenerated when a source changes.

Signals over time

2026-10-14Added to CISA's Known Exploited Vulnerabilities catalog.
2026-10-17Federal patch deadline for US agencies.
2026-11-03 21:55First seen here.

Source text

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.