CVE-2026-105133

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-105133
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://vuldb.com/cve/CVE-2026-105133 Third Party Advisory VDB Entry
https://vuldb.com/submit/942688 Third Party Advisory VDB Entry
https://vuldb.com/vuln/413350 Third Party Advisory VDB Entry
https://vuldb.com/vuln/413350/cti Permissions Required VDB Entry
https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update Vendor Advisory
https://www.huntress.com/blog/ahsaycbs-flaws-exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*
History

26 Oct 2026, 18:07

Type Values Removed Values Added
References () https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update - () https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update - Vendor Advisory
References () https://www.huntress.com/blog/ahsaycbs-flaws-exploit - () https://www.huntress.com/blog/ahsaycbs-flaws-exploit - Third Party Advisory

26 Oct 2026, 15:16

Type Values Removed Values Added
References
  • {'url': 'https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4', 'tags': ['Release Notes'], 'source': 'cna@vuldb.com'}
  • () https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update -
  • () https://www.huntress.com/blog/ahsaycbs-flaws-exploit -
Summary (en) A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component. (en) A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

15 Oct 2026, 13:47

Type Values Removed Values Added
CPE cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*
References () https://vuldb.com/cve/CVE-2026-105133 - () https://vuldb.com/cve/CVE-2026-105133 - Third Party Advisory, VDB Entry
References () https://vuldb.com/submit/942688 - () https://vuldb.com/submit/942688 - Third Party Advisory, VDB Entry
References () https://vuldb.com/vuln/413350 - () https://vuldb.com/vuln/413350 - Third Party Advisory, VDB Entry
References () https://vuldb.com/vuln/413350/cti - () https://vuldb.com/vuln/413350/cti - Permissions Required, VDB Entry
References () https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4 - () https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4 - Release Notes
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133 - US Government Resource
First Time Ahsay cloud Backup Suite
Ahsay

14 Oct 2026, 20:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133 -

04 Oct 2026, 07:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-04 07:16

Updated : 2026-10-26 18:07

NVD link : CVE-2026-105133

Mitre link : CVE-2026-105133

CVE.ORG link : CVE-2026-105133

JSON object : View

Products Affected

ahsay

  • cloud_backup_suite
CWE
CWE-287

Improper Authentication