CVE-2026-105133
MEDIUM CISA KEV
ACT NOW
Priority: 5.48
BB Relevance:
84/100
Published: 2026-10-04
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
None
VC:
Low
VI:
Low
VA:
Low
Description
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
CISA Known Exploited Vulnerability
Vendor / Product
Ahsay — AhsayCBS
Date Added
2026-10-14
Remediation Due
2026-10-17
https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105133
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| ahsay | cloud_backup_suite | < 9.15.2.70 |
| ahsay | cloud_backup_suite | 10.1.0 – 10.3.4.45 |
References & Advisories (7)
Vendor Advisory
US Government Resource
Third Party Advisory
VDB Entry
Third Party Advisory
VDB Entry
Third Party Advisory
VDB Entry
Third Party Advisory
Permissions Required
VDB Entry