CISA lists AhsayCBS authentication flaw in KEV (CVE-2026-105133)
Original title: CISA KEV: Ahsay AhsayCBS Improper Authentication Vulnerability — Ahsay AhsayCBS (CVE-2026-105133)
Manipulating the random argument in checkSysPwd bypasses API authentication on AhsayCBS through 10.3.2; 10.3.4 is the fix.
CISA added CVE-2026-105133, an improper-authentication flaw in Ahsay AhsayCBS, to the Known Exploited Vulnerabilities catalog. Manipulating the random argument in checkSysPwd, in com/ahsay/obs/api/ApiStructsAction.java, lets an attacker bypass authentication remotely. Versions up to 10.3.2 are affected; upgrading to 10.3.4 mitigates the issue. A public exploit exists, and the federal due date is October 17, 2026.
Unconfirmed: The entry says the public exploit may be used and does not name specific attacks or ransomware use.
- The affected function is checkSysPwd in the API component.
- The manipulated argument is named random.
- The attack can be initiated remotely.
- Known ransomware campaign use is listed as unknown.
Impact: Remote improper authentication against the AhsayCBS API
| Product | Affected | Fixed in |
|---|---|---|
| AhsayCBS | up to 10.3.2 | 10.3.4 |
- 1.Upgrade AhsayCBS to version 10.3.4.
- 2.Apply vendor mitigations and meet BOD 26-04 by October 17, 2026.
- CVEs
- CVE-2026-105133
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105133 | Improper authentication in Ahsay AhsayCBS API | 6.9 | 84% | KEV | KEV |
From the original article
1 min read at cisa.govA vulnerability was detected in Ahsay AhsayCBS up to 10. 3. 2.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.