CVE-2026-105133

Modified Modified - Updated After Analysis

BaseFortify

Publication date: 2026-10-04

Last updated on: 2026-10-26

Assigner: VulDB

Description

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-26

Generated

2026-11-08

AI Q&A

2026-10-04

EPSS Evaluated

2026-11-07

NVD

CVE-2026-105133

EUVD

EUVD-2026-92079

Affected Vendors & Products

Vendor	Product	Version / Range
ahsay	cloud_backup_suite	to 9.15.2.70 (exc)
ahsay	cloud_backup_suite	From 10.1.0 (inc) to 10.3.4.45 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

CVE-2026-105133 is an improper authentication vulnerability in AhsayCBS up to version 10.3.2. It exists in the function checkSysPwd in the file com/ahsay/obs/api/ApiStructsAction.java. The vulnerability allows remote attackers to manipulate the random argument to bypass authentication.

Detection Guidance

The vulnerability affects AhsayCBS up to version 10.3.2 in the API component. Detection involves checking the installed version of AhsayCBS. If the version is 10.3.2 or earlier, the system is vulnerable. No specific commands are provided in the context, but verifying the software version is the primary detection method.

Impact Analysis

This vulnerability enables remote attackers to gain unauthorized access to the AhsayCBS system without proper authentication. Attackers could exploit it to perform unauthorized actions, access sensitive data, or disrupt services. The exploit is public, increasing the risk of active attacks.

Compliance Impact

Improper authentication can lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. This may result in legal penalties, loss of compliance certifications, and reputational damage for organizations using the affected software.

Mitigation Strategies

Upgrade AhsayCBS to version 10.3.4 or later to mitigate the vulnerability. The context does not provide specific commands for upgrading, but following the official release notes and installation instructions from Ahsay is recommended.

Hi! I’m here to help you understand CVE-2026-105133. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...