[CVE-2026-105134] Ahsay AhsayCBS — Ahsay AhsayCBS Command Injection Vulnerability

What happened?

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

Key details

• Citrix NetScaler ADC and Gateway have a memory buffer vulnerability that could allow remote code execution or denial of service.
• Forensic triage is required per BOD 26-04.
• The vulnerability was added on 2026-09-27 with a due date of 2026-09-30.
• Organizations must apply mitigations per vendor instructions and comply with CISA BOD 26-04 guidance.
• Running IOCs in the NetScaler console may help identify exploitation indicators.

Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.