CVE-2026-105133: Ahsay AhsayCBS authentication bypass (KEV)
CVE-2026-105133 is an authentication-bypass vulnerability in the checkSysPwd function of Ahsay AhsayCBS's API that lets a remote attacker manipulate the "random" request argument to bypass authentication; Ahsay's first attempt at a fix was incomplete and had to be followed by a corrective hotfix, FIRST scores exploitation probability in the 99.6th percentile, and CISA added it to KEV.
Vulnerability summary
| Vulnerability ID | CVE-2026-105133 |
|---|---|
| CVSS score | 7.3 |
| EPSS score | 0.79236 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-10-04T07:16:33.087 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Ahsay AhsayCBS backup server, API component (com/ahsay/obs/api/ApiStructsAction.java, checkSysPwd function) | — | AhsayCBS up to 10.3.2, and earlier v7/v8/v9 builds; Ahsay's initial hotfix did not fully address the issue, superseded by v10.3.4.45 (v10 line) and v9.15.2.70 (v7/v8/v9 line), both published 2026-10-12. |
What this means
CVE-2026-105133 (CWE-287, improper authentication) affects Ahsay AhsayCBS, a backup management server. NVD's description states: "A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication" (NVD).
NVD lists the CVE as "Analyzed" and records a CVSS v3.1 base score of 7.3 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, submitted by a secondary CNA (VulDB) (NVD).
Ahsay's own announcement, published 2026-10-12, addresses CVE-2026-105133 together with a related CVE-2026-105134 and states plainly that the vendor's earlier patches "did not fully address" these vulnerabilities; it directs AhsayCBS v10 customers to apply hotfix v10.3.4.45 and v7/v8/v9 customers to apply hotfix v9.15.2.70, both requiring a server reboot after installation (Ahsay Security Alert — patch update for CVE-2026-105133 / CVE-2026-105134).
CISA added CVE-2026-105133 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, with a required-action due date of 2026-10-17 and known ransomware use recorded as "Unknown," and directs agencies to CISA's BOD 26-04 forensic-triage guidance (CISA KEV).
As of 2026-10-25, FIRST scores the probability of exploitation at 0.79236 (99.595th percentile) — markedly higher than the other advisories on this site, consistent with its KEV listing and the fact that the first vendor fix was incomplete (FIRST EPSS).
This is not an OT/ICS CVE; it is published here as a KEV-confirmed, high-EPSS authentication-bypass affecting a widely used backup platform, meeting this page's indexing bar (NVD Analyzed status plus a real NVD CVSS) at a point when no fresher OT/ICS CVE had completed NVD analysis. Operators running AhsayCBS must confirm they are on the corrective hotfix (v10.3.4.45 or v9.15.2.70) — an earlier patch level for this CVE is not sufficient — and restrict network access to the management interface in the meantime.
Evidence
- Manipulating the "random" argument to the checkSysPwd function in AhsayCBS's API component results in improper authentication, up to version 10.3.2 (CWE-287). — NVD
- NVD status is "Analyzed" with a CVSS v3.1 base score of 7.3 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. — NVD
- Ahsay's earlier patch did not fully address CVE-2026-105133 (bundled with CVE-2026-105134); corrective hotfixes v10.3.4.45 (v10) and v9.15.2.70 (v7/v8/v9) published 2026-10-12, reboot required. — Ahsay Security Alert — patch update for CVE-2026-105133 / CVE-2026-105134
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-14, due date 2026-10-17, known ransomware use recorded as "Unknown". — CISA KEV
- EPSS score is 0.79236 (99.595th percentile) as of 2026-10-25. — FIRST EPSS