updatereceivers[.]doDomain

1. “The flaw affects the /rps/api/json/UpdateReceivers[.]do endpoint and could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying system.”

   Security AffairsNews15 Oct 2026
   U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog

2. “The published CVE description classifies CVE-2026-105134 as OS command injection affecting /rps/api/json/UpdateReceivers[.]do in the Replication Receiver component.”

   Horizon3.aiVendor15 Oct 2026
   CVE-2026-105133 and CVE-2026-105134 | AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities

3. “Starting from the configuration side, an auth-bypassed call to UpdateReceivers[.]do with Id=0 creates a new V7 receiver.”

   Horizon3.aiVendor14 Oct 2026
   AhsayCBS Deep-Dive: Auth Bypass to RCE

4. “… kenmerk CVE-2026-105134 heeft een CVSS-score van 10,0 en betreft OS-command-injectie in de Replication Receiver via /rps/api/json/UpdateReceivers[.]do.”

   NCSC-NL advisoriesGovernment14 Oct 2026
   NCSC-2026-0427 [1.00] [M/H] Kwetsbaarheden verholpen in Ahsay AhsayCBS

5. “CVE-2026-105134: A critical-severity vulnerability affecting /rps/api/json/UpdateReceivers[.]do of the component Replication Receiver in AhsayCBS, which can be exploited to achieve unauthenticated remote code execution as NT AUTHORITY/SYSTEM on the host.”

   HuntressVendor8 Oct 2026
   Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

• 177.4.12[.]11in 1 report
• apistructsaction[.]javain 1 report
• 51.195.127[.]124in 1 report
• hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/Taskgmr.ps1in 1 report
• 38.60.252[.]110in 1 report
• 107.191.47[.]199in 1 report
• 185.220.236[.]49in 1 report
• 104.234.26[.]10in 1 report
• 123.202.208[.]37in 1 report
• hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/edge.exein 1 report
• hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/msedge.exein 1 report
• hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/config.jsonin 1 report
• hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/WinRing0x64.sysin 1 report
• 05f69ae6b2b89c1c…045d06139034in 1 report
• 4dcb0202fe8b2d4d…f4bce1dd6f3din 1 report
• 481728a7c9c4c02b…4818e3d25d21in 1 report

Also named with it: CVE-2026-105133, CVE-2026-105134, CVE-2026-76519, CVE-2026-0322