CVE-2026-105133 Ahsay AhsayCBS Improper Authentication
Attackers can bypass authentication in the AhsayCBS API by manipulating the random argument, allowing unauthorized access.
- Exploited in the wild
- Since 14 Oct 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105133?
CVE-2026-105133 is a medium-severity authentication bypass vulnerability in AhsayCBS, published on 4 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
Weakness: CWE-287
Which versions are affected by CVE-2026-105133?
It affects 1 product.
Products include Ahsay Cloud Backup Suite.
How do I fix CVE-2026-105133?
No fix has been published for CVE-2026-105133 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Oct 2026.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-105133 being exploited?
Yes. Attackers have exploited CVE-2026-105133 in the wild since at least 14 Oct 2026.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in AhsayCBS
Sources
Also known as GHSA-fp2j-3cmp-828j.