CVE-2026-105133

Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

Published Oct 4, 2026 CVSS 4.0 · 6.9 Medium EPSS 84.5% KEV · Listed

Description

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Ahsay

AhsayCBS

affected

Version	Status	Constraints
`9.15.2.0`	affected	—
`9.15.2.1`	affected	—
`9.15.2.2`	affected	—
`9.15.2.3`	affected	—
`9.15.2.4`	affected	—
`9.15.2.5`	affected	—
`9.15.2.6`	affected	—
`9.15.2.7`	affected	—
`9.15.2.8`	affected	—
`9.15.2.9`	affected	—
`9.15.2.10`	affected	—
`9.15.2.11`	affected	—
`9.15.2.12`	affected	—
`9.15.2.13`	affected	—
`9.15.2.14`	affected	—
`9.15.2.15`	affected	—
`9.15.2.16`	affected	—
`9.15.2.17`	affected	—
`9.15.2.18`	affected	—
`9.15.2.19`	affected	—
`9.15.2.20`	affected	—
`9.15.2.21`	affected	—
`9.15.2.22`	affected	—
`9.15.2.23`	affected	—
`9.15.2.24`	affected	—
`9.15.2.25`	affected	—
`9.15.2.26`	affected	—
`9.15.2.27`	affected	—
`9.15.2.28`	affected	—
`9.15.2.29`	affected	—
`9.15.2.30`	affected	—
`9.15.2.31`	affected	—
`9.15.2.32`	affected	—
`9.15.2.33`	affected	—
`9.15.2.34`	affected	—
`9.15.2.35`	affected	—
`9.15.2.36`	affected	—
`9.15.2.37`	affected	—
`9.15.2.38`	affected	—
`9.15.2.39`	affected	—
`9.15.2.40`	affected	—
`9.15.2.41`	affected	—
`9.15.2.42`	affected	—
`9.15.2.43`	affected	—
`9.15.2.44`	affected	—
`9.15.2.45`	affected	—
`9.15.2.46`	affected	—
`9.15.2.47`	affected	—
`9.15.2.48`	affected	—
`9.15.2.49`	affected	—
`9.15.2.50`	affected	—
`9.15.2.51`	affected	—
`9.15.2.52`	affected	—
`9.15.2.53`	affected	—
`9.15.2.54`	affected	—
`9.15.2.55`	affected	—
`9.15.2.56`	affected	—
`9.15.2.57`	affected	—
`9.15.2.58`	affected	—
`9.15.2.59`	affected	—
`9.15.2.60`	affected	—
`9.15.2.61`	affected	—
`9.15.2.62`	affected	—
`9.15.2.63`	affected	—
`9.15.2.64`	affected	—
`9.15.2.65`	affected	—
`9.15.2.66`	affected	—
`9.15.2.67`	affected	—
`9.15.2.68`	affected	—
`9.15.2.69`	affected	—
`10.3.4.0`	affected	—
`10.3.4.1`	affected	—
`10.3.4.2`	affected	—
`10.3.4.3`	affected	—
`10.3.4.4`	affected	—
`10.3.4.5`	affected	—
`10.3.4.6`	affected	—
`10.3.4.7`	affected	—
`10.3.4.8`	affected	—
`10.3.4.9`	affected	—
`10.3.4.10`	affected	—
`10.3.4.11`	affected	—
`10.3.4.12`	affected	—
`10.3.4.13`	affected	—
`10.3.4.14`	affected	—
`10.3.4.15`	affected	—
`10.3.4.16`	affected	—
`10.3.4.17`	affected	—
`10.3.4.18`	affected	—
`10.3.4.19`	affected	—
`10.3.4.20`	affected	—
`10.3.4.21`	affected	—
`10.3.4.22`	affected	—
`10.3.4.23`	affected	—
`10.3.4.24`	affected	—
`10.3.4.25`	affected	—
`10.3.4.26`	affected	—
`10.3.4.27`	affected	—
`10.3.4.28`	affected	—
`10.3.4.29`	affected	—
`10.3.4.30`	affected	—
`10.3.4.31`	affected	—
`10.3.4.32`	affected	—
`10.3.4.33`	affected	—
`10.3.4.34`	affected	—
`10.3.4.35`	affected	—
`10.3.4.36`	affected	—
`10.3.4.37`	affected	—
`10.3.4.38`	affected	—
`10.3.4.39`	affected	—
`10.3.4.40`	affected	—
`10.3.4.41`	affected	—
`10.3.4.42`	affected	—
`10.3.4.43`	affected	—
`10.3.4.44`	affected	—
`9.15.2.70`	unaffected	—
`10.3.4.45`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:ahsay:cloud_backup_suite::::::::
	cpe:2.3:a:ahsay:cloud_backup_suite::::::::

No data.

Vendor Product Versions

Ahsay

Ahsaycbs

Version	Status	Scheme	Platform
`10.3.0`	affected	semver	—
`10.3.1`	affected	semver	—
`10.3.2`	affected	semver	—
`10.3.4`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is in the KEV database since Oct. 14, 2026.

Exploit prediction score: 84.5% (84.478% probability within 30 days)

Exploitation active

Automatable yes

Technical Impact partial

References

Link	Providers
https://vuldb.com/cve/CVE-2026-105133
https://vuldb.com/submit/942688
https://vuldb.com/vuln/413350
https://vuldb.com/vuln/413350/cti
https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
https://www.huntress.com/blog/ahsaycbs-flaws-exploit

History

Oct 26, 2026 3:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4

Oct 26, 2026 3:00 PM Description updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.	A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
References		https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update https://www.huntress.com/blog/ahsaycbs-flaws-exploit
Metrics	cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`	cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A'}`

Oct 15, 2026 2:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ahsay cloud Backup Suite
CPEs		cpe:2.3:a:ahsay:cloud_backup_suite::::::::
Vendors & Products		Ahsay cloud Backup Suite

Oct 14, 2026 8:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 14, 2026 7:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2026-10-14T00:00:00+00:00', 'dueDate': '2026-10-17T00:00:00+00:00'}`

Oct 5, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 4, 2026 6:45 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.
Title		Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
First Time appeared		Ahsay Ahsay ahsaycbs
Weaknesses		CWE-287
CPEs		cpe:2.3:a:ahsay:ahsaycbs::::::::
Vendors & Products		Ahsay Ahsay ahsaycbs
References		https://vuldb.com/cve/CVE-2026-105133 https://vuldb.com/submit/942688 https://vuldb.com/vuln/413350 https://vuldb.com/vuln/413350/cti https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`