{"id":"CVE-2026-105133","published":"2026-10-04T07:16:33Z","modified":"2026-10-26T18:07:09Z","title":"Ahsay AhsayCBS Improper Authentication Vulnerability","vendor":"Ahsay","product":"AhsayCBS","tier":"core","eol":null,"description":{"text":"A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper authentication vulnerability in the checkSysPwd function of ApiStructsAction.java in the API component of Ahsay AhsayCBS, affecting versions up to 9.15.2.69 and 10.3.4.44. An attacker who can reach the service over the network can exploit it without authentication or user interaction, by manipulating the random argument, and the exploit is publicly available.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:00Z"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.7947,"percentile":0.99602,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2026-10-14","dueDate":"2026-10-17","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105133","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-10-09","exploitedFirstSeen":"2026-10-09","ransomware":false,"evidence":[{"url":"https://www.huntress.com/blog/ahsaycbs-flaws-exploit","date":"2026-10-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-27&host_type=src&vulnerability=cve-2026-105133","date":"2026-10-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-28&host_type=src&vulnerability=cve-2026-105133","date":"2026-10-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-29&host_type=src&vulnerability=cve-2026-105133","date":"2026-10-29"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":25,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134).","url":"https://otx.alienvault.com/pulse/6ade1331bc5a7e0c8c6e771c","created":"2026-10-25"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"AhsayCBS Backup Console Under Active Exploitation: CVE-2026-105133/105134 Chain Leads From Auth Bypass to RCE, and 10.3.4.0 Does Not Close It .","url":"https://otx.alienvault.com/pulse/6ad75b2fdad28fe85e48ec5b","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-105133","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/submit/942688","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/vuln/413350","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/vuln/413350/cti","tags":["Permissions Required","VDB Entry"]},{"url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","tags":["Vendor Advisory"]},{"url":"https://www.huntress.com/blog/ahsaycbs-flaws-exploit","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote exploitation of exposed application API","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"It is possible to initiate the attack remotely","start":271,"end":317}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Authentication bypass yields valid-looking access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"results in improper authentication","start":235,"end":269}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-92079","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92079","exploited":true,"exploitedSince":"2026-10-14","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-10-14","earliestUrl":"https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE","repos":[{"name":"horizon3ai/AhsayCBS-Auth-Bypass-RCE","url":"https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE","stars":4,"created":"2026-10-14"}]},"nuclei":[{"id":"CVE-2026-105133","name":"AhsayCBS - JSON API Authentication Bypass","severity":"medium","path":"http/cves/2026/CVE-2026-105133.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-105133.yaml"}],"first":{"date":"2026-10-14","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2026-10-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105133","provenance":"source"},{"date":"2026-10-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.huntress.com/blog/ahsaycbs-flaws-exploit","provenance":"source"},{"date":"2026-10-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE","provenance":"source"},{"date":"2026-10-14","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-10-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92079","provenance":"source"}],"speed":{"daysToPublicExploit":10,"firstExploitFrom":"PoC-in-GitHub","daysToKev":10},"priority":{"score":78.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 21 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9960"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"25 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}