CVE-2026-105133

Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

No known exploitation. EPSS puts it in the 30th percentile. Fixed in 10.3.4.

CVSS 3.17.3High EPSS percentile30th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix10.3.4Upgrade to this build

Published 2026-10-04Updated 2026-10-06Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

AhsayCBSAffected: 10.3.0Upgrade to: not statedAffected: 10.3.1Upgrade to: not statedAffected: 10.3.2Upgrade to: not statedFixed builds10.3.4Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you're running Ahsay AhsayCBS version 10.3.2 or earlier — if so, you are affected.
Take the server offline from the internet or restrict access immediately if you cannot patch right away.
Upgrade to AhsayCBS version 10.3.4, which fixes this issue.
Check the server for signs of compromise: unknown JSP files (webshells), high CPU usage, or unfamiliar processes (possible cryptocurrency miners).
If you find signs of compromise, treat it as a breach — rotate credentials and consult an incident response professional.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

Exploitation reported in the wild
as reported · Oct 9, 2026·BleepingComputer summary

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

In plain language

Written by AI from the record

Attackers are actively breaking into AhsayCBS backup servers right now by tricking the login system, then installing hidden malware and crypto-mining software — if you run this backup software, treat it as an emergency.

Improper authentication in AhsayCBS's checkSysPwd API (ApiStructsAction.java) lets an unauthenticated remote attacker manipulate the 'random' parameter to bypass login, and it's being chained in the wild with CVE-2026-105134 for unauthenticated RCE, webshell deployment, and cryptomining.

If you're affected

Full backup server takeover
Customer/client data exposure
Ransomware or cryptomining infection
Operational disruption to backups
Hidden backdoor (webshell) access

What is it

AhsayCBS is backup management software — think of it as the master control panel for all your company's backed-up data. This flaw is like a broken front-door lock that lets anyone claiming to be an admin walk straight in without a key, and attackers are already using it to plant hidden programs that mine cryptocurrency on your server and potentially tamper with your backups.

Who is affected

This matters to you if you run Ahsay AhsayCBS (version 10.3.2 or earlier) as your backup management server. No login credentials are needed for an attacker to exploit this, and it's reachable directly over the internet in the default setup — so any internet-facing AhsayCBS server is at risk right now.

How urgent is it

Attackers are already exploiting this flaw in real-world attacks — at least five organizations have had webshells and cryptocurrency miners installed on their AhsayCBS servers since early October 2026. This is not a theoretical risk; it's an active, ongoing campaign, so action is needed immediately rather than on a routine patch schedule.

What to do — in detail

Confirm your AhsayCBS version; versions up to and including 10.3.2 are vulnerable via the checkSysPwd function in ApiStructsAction.java, exploitable by manipulating the 'random' parameter to bypass authentication.
If internet-facing and unpatched, restrict network access to the API immediately (firewall/VPN-only) as a stopgap — this is not a full fix, only a delay tactic.
Upgrade to version 10.3.4, which addresses this issue; review the official release notes for any upgrade/migration notes (https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4).
Be aware this flaw is actively chained with CVE-2026-105134 for unauthenticated remote code execution — patching only this CVE without addressing the chained vulnerability may leave exposure; confirm both are fixed in 10.3.4.
Hunt for indicators of compromise: unexpected JSP files in web-accessible directories (webshells), XMRig or unfamiliar mining processes, anomalous outbound connections, and unauthorized admin accounts.
If compromise is confirmed, isolate the host, preserve logs/forensic evidence, rotate all credentials and API keys, and engage incident response before trusting any existing backups from that server.
Not in CISA KEV as of this writing, so no federal remediation deadline applies, but given active exploitation treat this with KEV-level urgency internally.

Technical context

CVSS 3.1 score 7.3 (HIGH), vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L — network-exploitable, low complexity, no privileges or user interaction required, with limited confidentiality/integrity/availability impact individually (though chained with CVE-2026-105134 it enables full RCE). Weakness is CWE-287 (Improper Authentication), rooted in flawed validation of the 'random' parameter in the checkSysPwd function. No public exploit code is on record, but news reporting confirms active in-the-wild exploitation since 2026-10-07 across at least five organizations, involving JSP webshell deployment and XMRig cryptominer installation. Not currently listed in CISA KEV. EPSS prediction is low and flat, but this is superseded by confirmed real-world exploitation — treat as actively exploited regardless of EPSS score.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS30th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 30th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

6 events over 2 days, from the signal feeds we watch.

2026-10-06Record updated
2026-10-05Record updated
2026-10-04Publishedweakness classified, att&ck mapped, record updated

Affected products

Ahsaycommercialaka ah say, ahsay backup
- AhsayCBSSaaSEnterprise Software / itsm-monitoring

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Scored 7.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service