---
id: CVE-2026-105133
title: A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2
summary: >-
  A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the
  function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of
  the component API. Performing a manipulation of the argument random results in
  impr…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-287
vendor: ahsay
product: cloud_backup_suite
affected:
  - cloud_backup_suite < 10.3.4
patched:
  - cloud_backup_suite 10.3.4
published: '2026-10-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T13:47:06.283'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105133'
references:
  - url: 'https://vuldb.com/cve/CVE-2026-105133'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/942688'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/413350'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/413350/cti'
    label: cna@vuldb.com
  - url: 'https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4'
    label: cna@vuldb.com
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update
  - url: 'https://www.huntress.com/blog/ahsaycbs-flaws-exploit'
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
  - cve.org
epss: 0.7947
epssPercentile: 0.99601
kev: true
kevDateAdded: '2026-10-14'
kevDueDate: '2026-10-17'
kevRansomware: false
exploited: true
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE'
  nuclei:
    - CVE-2026-105133
  checkedAt: '2026-10-27T16:54:16.966Z'
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-14T19:32:53.128750Z'
ingestedAt: '2026-10-04T06:55:02.309Z'
---

## Overview

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

## Affected

- `cloud_backup_suite < 10.3.4`

## Remediation

Upgrade past the affected range:

- `cloud_backup_suite 10.3.4`