AhsayCBS issue could allow unintended commands to run

What happened

• Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.CISA BOD 22-01 Catalog (CVE-2026-105134)
• Mandatory remediation: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.Remediation Deadline: 2026-10-17

Contributing factors stated by the source

• Actively exploited in production systems pursuant to CISA Binding Operational Directive BOD 22-01
• Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

The failure pattern

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

• ASI01 Agent Goal Hijack
• ASI02 Tool Misuse and Exploitation
• ASI06 Memory and Context Poisoning
• LLM01 Prompt Injection
• LLM02 Sensitive Information Disclosure
• AC-4 Information Flow Enforcement
• SI-10 Information Input Validation
• MAP 5.1 Estimate impacts from past uses and public incident reports
• Goal 3 Reducing entire classes of vulnerability
• CWE-1427 Improper Neutralization of Input Used for LLM Prompting

Incidents with the same pattern