CVE-2026-105133 - Vulnerability Details

- Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

Description

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

Published: 2026-10-04

Score: 6.9 Medium

EPSS: 79.2% High

KEV: Yes

Impact:

Action:

Analysis

Impact

The vulnerability resides in the checkSysPwd method of the ApiStructsAction component in Ahsay AhsayCBS. By manipulating the random argument, an attacker can bypass the authentication mechanism, enabling unauthorized calls to the system’s API endpoints. The flaw is exploitable remotely, and the exploit is now publicly known; attackers can gain unauthorized access to sensitive data or facilitate further attacks. The initial patch release did not fully address the issue, but subsequent releases include the proper fix.

Affected Systems

The vulnerability affects Ahsay AhsayCBS versions up to 9.15.2.69 and 10.3.4.44. Updating to version 9.15.2.70 or 10.3.4.45 removes the flaw.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the vulnerability is exploitable remotely. The EPSS score of 79% signifies a high likelihood that the flaw will be exploited. The exploit is public and the vulnerability is listed in the CISA KEV catalog, indicating that attackers are actively targeting it. Attackers can trigger the flaw by manipulating the random argument, bypassing authentication checks and impersonating legitimate users without valid credentials. This can lead to unauthorized access to API endpoints and potential exposure of sensitive data or the ability to launch further attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Ahsay

AhsayCBS

affected

Version	Status	Constraints
`9.15.2.0`	affected	—
`9.15.2.1`	affected	—
`9.15.2.2`	affected	—
`9.15.2.3`	affected	—
`9.15.2.4`	affected	—
`9.15.2.5`	affected	—
`9.15.2.6`	affected	—
`9.15.2.7`	affected	—
`9.15.2.8`	affected	—
`9.15.2.9`	affected	—
`9.15.2.10`	affected	—
`9.15.2.11`	affected	—
`9.15.2.12`	affected	—
`9.15.2.13`	affected	—
`9.15.2.14`	affected	—
`9.15.2.15`	affected	—
`9.15.2.16`	affected	—
`9.15.2.17`	affected	—
`9.15.2.18`	affected	—
`9.15.2.19`	affected	—
`9.15.2.20`	affected	—
`9.15.2.21`	affected	—
`9.15.2.22`	affected	—
`9.15.2.23`	affected	—
`9.15.2.24`	affected	—
`9.15.2.25`	affected	—
`9.15.2.26`	affected	—
`9.15.2.27`	affected	—
`9.15.2.28`	affected	—
`9.15.2.29`	affected	—
`9.15.2.30`	affected	—
`9.15.2.31`	affected	—
`9.15.2.32`	affected	—
`9.15.2.33`	affected	—
`9.15.2.34`	affected	—
`9.15.2.35`	affected	—
`9.15.2.36`	affected	—
`9.15.2.37`	affected	—
`9.15.2.38`	affected	—
`9.15.2.39`	affected	—
`9.15.2.40`	affected	—
`9.15.2.41`	affected	—
`9.15.2.42`	affected	—
`9.15.2.43`	affected	—
`9.15.2.44`	affected	—
`9.15.2.45`	affected	—
`9.15.2.46`	affected	—
`9.15.2.47`	affected	—
`9.15.2.48`	affected	—
`9.15.2.49`	affected	—
`9.15.2.50`	affected	—
`9.15.2.51`	affected	—
`9.15.2.52`	affected	—
`9.15.2.53`	affected	—
`9.15.2.54`	affected	—
`9.15.2.55`	affected	—
`9.15.2.56`	affected	—
`9.15.2.57`	affected	—
`9.15.2.58`	affected	—
`9.15.2.59`	affected	—
`9.15.2.60`	affected	—
`9.15.2.61`	affected	—
`9.15.2.62`	affected	—
`9.15.2.63`	affected	—
`9.15.2.64`	affected	—
`9.15.2.65`	affected	—
`9.15.2.66`	affected	—
`9.15.2.67`	affected	—
`9.15.2.68`	affected	—
`9.15.2.69`	affected	—
`10.3.4.0`	affected	—
`10.3.4.1`	affected	—
`10.3.4.2`	affected	—
`10.3.4.3`	affected	—
`10.3.4.4`	affected	—
`10.3.4.5`	affected	—
`10.3.4.6`	affected	—
`10.3.4.7`	affected	—
`10.3.4.8`	affected	—
`10.3.4.9`	affected	—
`10.3.4.10`	affected	—
`10.3.4.11`	affected	—
`10.3.4.12`	affected	—
`10.3.4.13`	affected	—
`10.3.4.14`	affected	—
`10.3.4.15`	affected	—
`10.3.4.16`	affected	—
`10.3.4.17`	affected	—
`10.3.4.18`	affected	—
`10.3.4.19`	affected	—
`10.3.4.20`	affected	—
`10.3.4.21`	affected	—
`10.3.4.22`	affected	—
`10.3.4.23`	affected	—
`10.3.4.24`	affected	—
`10.3.4.25`	affected	—
`10.3.4.26`	affected	—
`10.3.4.27`	affected	—
`10.3.4.28`	affected	—
`10.3.4.29`	affected	—
`10.3.4.30`	affected	—
`10.3.4.31`	affected	—
`10.3.4.32`	affected	—
`10.3.4.33`	affected	—
`10.3.4.34`	affected	—
`10.3.4.35`	affected	—
`10.3.4.36`	affected	—
`10.3.4.37`	affected	—
`10.3.4.38`	affected	—
`10.3.4.39`	affected	—
`10.3.4.40`	affected	—
`10.3.4.41`	affected	—
`10.3.4.42`	affected	—
`10.3.4.43`	affected	—
`10.3.4.44`	affected	—
`9.15.2.70`	unaffected	—
`10.3.4.45`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:ahsay:cloud_backup_suite::::::::
	cpe:2.3:a:ahsay:cloud_backup_suite::::::::

No data.

Vendor Product Confidence Versions

Ahsay

Ahsaycbs

100%

Version	Status	Scheme	Platform
`10.3.0`	affected	semver	—
`10.3.1`	affected	semver	—
`10.3.2`	affected	semver	—
`10.3.4`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Ahsay CBS 9.15.2.70 or 10.3.4.45 or later to remove the vulnerable code.
If an update cannot be applied immediately, restrict access to the affected API endpoints using firewall rules or network segmentation, allowing only trusted IP ranges to interact with the service.
Enable detailed authentication logs and monitor for attempts that manipulate the random argument or show unauthorized access, reporting any suspicious behavior to the security team.

Generated by OpenCVE AI on October 26, 2026 at 16:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is in the KEV database since Oct. 14, 2026.

The EPSS score is 0.79236.

Exploitation active

Automatable yes

Technical Impact partial

References

Link	Providers
https://vuldb.com/cve/CVE-2026-105133
https://vuldb.com/submit/942688
https://vuldb.com/vuln/413350
https://vuldb.com/vuln/413350/cti
https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
https://www.huntress.com/blog/ahsaycbs-flaws-exploit

History

Mon, 26 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
References	https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4

Mon, 26 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description	A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.	A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
References		https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update https://www.huntress.com/blog/ahsaycbs-flaws-exploit
Metrics	cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`	cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A'}`

Thu, 15 Oct 2026 14:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ahsay cloud Backup Suite
CPEs		cpe:2.3:a:ahsay:cloud_backup_suite::::::::
Vendors & Products		Ahsay cloud Backup Suite

Wed, 14 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 14 Oct 2026 19:45:00 +0000

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2026-10-14T00:00:00+00:00', 'dueDate': '2026-10-17T00:00:00+00:00'}`

Mon, 05 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 04 Oct 2026 06:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.
Title		Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
First Time appeared		Ahsay Ahsay ahsaycbs
Weaknesses		CWE-287
CPEs		cpe:2.3:a:ahsay:ahsaycbs::::::::
Vendors & Products		Ahsay Ahsay ahsaycbs
References		https://vuldb.com/cve/CVE-2026-105133 https://vuldb.com/submit/942688 https://vuldb.com/vuln/413350 https://vuldb.com/vuln/413350/cti https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Ahsay Ahsaycbs Cloud Backup Suite

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-04T05:15:14.561Z

Updated: 2026-10-26T14:31:10.237Z

Reserved: 2026-10-03T13:13:31.953Z

Link: CVE-2026-105133

Vulnrichment

Updated: 2026-10-05T15:26:46.330Z

NVD

Status : Analyzed

Published: 2026-10-04T07:16:33.087

Modified: 2026-10-26T18:07:09.000

Link: CVE-2026-105133

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-26T16:45:14Z

Weaknesses

CWE-287
Improper Authentication

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation active

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object