CVE-2026-105134

Ahsay AhsayCBS suffered a command injection flaw allowing remote attackers to execute OS commands via the Replication Receiver component.

A remote attacker could execute arbitrary operating system commands by manipulating a parameter in the Replication Receiver component's UpdateReceivers.do endpoint. This is a critical failure for DIB organizations because it enables full system compromise, data exfiltration, and lateral movement, directly impacting compliance with NIST 800-171 requirements for system and communications protection. Organizations must ensure all backup and replication software is patched and monitored for exploitation attempts.

Shame score — A command injection vulnerability in a replication component allows remote code execution, which is a severe, avoidable failure that could lead to complete system compromise and data loss.