CISA Adds AhsayCBS Command Injection Vulnerability to KEV List

## Overview CISA has added CVE-2026-105134 to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability affects AhsayCBS versions up to 10.3.2. It allows remote attackers to execute operating system commands through a command injection flaw in the Replication Receiver component. ## Technical Details The vulnerability lies in the file `/rps/api/json/UpdateReceivers.do`. By manipulating the `random` parameter, an attacker can inject commands. The issue is serious, with a CVSS score of 9.3, indicating high severity. Evidence suggests that exploits for this vulnerability are already available in the wild. ## Impact Successful exploitation can lead to unauthorized access and control over the affected system. This could result in data breaches or further compromise of network integrity. Organizations using AhsayCBS should take immediate action to assess their exposure. ## Mitigation To mitigate this vulnerability, upgrade AhsayCBS to version 10.3.4 or later. This update addresses the command injection flaw. Organizations should also review their security posture and consider implementing additional monitoring for unusual activity related to this vulnerability.