CISA has added CVE-2026-105133 to its Known Exploited Vulnerabilities catalog. The flaw is a remotely exploitable authentication bypass in the API of Ahsay AhsayCBS. Affected organizations should upgrade to version 10.3.4.
What Is It
CVE-2026-105133 is an improper authentication vulnerability (CWE-287) in the API component of Ahsay AhsayCBS. The flaw is in the checkSysPwd function in com/ahsay/obs/api/ApiStructsAction.java. A remote attacker can bypass authentication by manipulating the random argument. The vulnerability record says it can be chained with CVE-2026-105134.
Why It Matters
CISA added CVE-2026-105133 to the KEV catalog on 2026-10-14, which indicates CISA has evidence of active exploitation. CISA's SSVC assessment rates exploitation as active, automatable as yes and technical impact as partial. The NVD record also says a public exploit is available. VulDB rates that exploit as proof-of-concept.
The attack works over the network, has low complexity, and needs no privileges or user interaction. The CNA (VulDB) gives it two scores. They differ because CVSS 3.1 and CVSS 4.0 are scored differently:
- CVSS 3.1: 7.3 HIGH (
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) - CVSS 4.0: 5.5 MEDIUM, with exploit maturity marked as proof-of-concept
KEV lists known ransomware campaign use as Unknown. The NVD record is still undergoing analysis.
What's Vulnerable
- Product: Ahsay AhsayCBS, API component
- Affected: versions up to 10.3.2. The record lists 10.3.0, 10.3.1 and 10.3.2 as affected.
- Unaffected: version 10.3.4
- Not stated: the record does not say whether version 10.3.3 is affected. Treat it as potentially vulnerable and upgrade to 10.3.4.
Patch Status
Ahsay has published a patch announcement covering CVE-2026-105133 and CVE-2026-105134. According to the NVD description, upgrading to AhsayCBS 10.3.4 addresses the issue.
CISA's required action is to apply mitigations according to the vendor's instructions. This must follow BOD 26-04 (Prioritizing Security Updates Based on Risk). The required-action text also points to CISA's Forensics Triage Requirements as general guidance. However, the KEV entry does not flag this CVE for forensic triage. Organizations should follow the BOD 26-04 guidance for cloud services, or stop using the product if no mitigations are available. Stakeholders must evaluate each asset's internet exposure. Federal agencies must remediate by 2026-10-17.
Sources
- CISA KEV Catalog – CVE-2026-105133
- NVD – CVE-2026-105133
- Ahsay Patch Announcement – CVE-2026-105133 / CVE-2026-105134
- Ahsay AhsayCBS v10.3.4 Release Notes
- VulDB – CVE-2026-105133
- VulDB – Vulnerability 413350
- CISA BOD 26-04 – Prioritizing Security Updates Based on Risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements)