CVE-2026-105134

CWE-77

Final Priority

Critical

104.4

Raw RPS

Description

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

Source: NVD

CVSS: 10.0; Critical · v3.1
EPSS: 38.31%; Probability of exploitation in the next 30 days (FIRST) · Percentile: 98.5%
CISA KEV: In CISA KEV since Oct 2026; Confirmed exploitation in the wild (CISA KEV)
Upstream fix commit: No verified fix commit in DevSecure data; Sources: MoreFixes, FreshFixes
SSVC inputs (CISA): Exploitation: Active · Automatable: Yes · Technical impact: Total; CISA's assessed SSVC inputs, not a decision. A decision also needs your mission and public well-being context. Context only; not part of the RPS score.
Weakness: CWE-77
Published: 4 Oct 2026; Last modified 15 Oct 2026

How to read these signals: RPS · EPSS · CISA KEV · Data sources

What would change this priority?

↓Would become High if the EPSS percentile falls below 66.6%, causing the raw RPS to fall below 90.

Explains the published RPS formula and priority rules; it doesn't change the score. How priority works

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2026-105134

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 23 Oct 2026, 05:17 UK time

This product uses the NVD API but is not endorsed or certified by the NVD. Data sources and licences

CVE-2026-105134

Description

Signals

What would change this priority?

Get this score from the API