Ahsay AhsayCBS
CVE-2026-105133: improper authentication in the AhsayCBS API.
A flaw in the checkSysPwd function of the AhsayCBS API lets a remote attacker manipulate the random argument and get past authentication. The exploit is public, CISA lists it as exploited, and it chains with the command injection in CVE-2026-105134.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 14 Oct 2026
- Federal due date 17 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 79% in 30 days
- Percentile 100%, scored 29 Oct 2026
- 6.9Medium, (CVSS 4.0)Scored by NVD
- 79%EPSS, chance of exploitation in 30 daysPercentile 100%; scored 29 Oct 2026
- 4 OctPublished by NVD4 Oct 2026; record read 26 Oct 2026
Versions
Affected and fixed.
.
| Affected | Fixed in |
|---|---|
| AhsayCBS v7 to v10 before the October hotfixes | AhsayCBS 10.3.4.45 hotfix, 9.15.2.70 hotfix for v7 to v9 |
What to do now
Apply the AhsayCBS hotfix and reboot the server afterwards. The release covering AhsayCBS beside PAN-OS and Cisco sits in our advisory.
How to check exposure
AhsayCBS prints its build on the backup server's console banner and in its system settings. Builds up to 9.15.2.69 and 10.3.4.44 are exposed; the hotfixes 9.15.2.70 and 10.3.4.45 are the fix. The NVD record notes that the initial patch did not fix the flaw, so a server patched once in early October needs the updated hotfix and a reboot.
A backup server reachable from the internet is the thing to find first: the API this flaw sits in is the one the backup clients talk to.
Who this reaches in Australia
AhsayCBS runs the backup service at managed service providers and the firms that bought backup from them, which makes it a service provider's single point of entry to many clients. An attacker past authentication on the backup server holds every client's backup set.
Under the Essential Eight the fix is patch applications for an internet-facing service within 48 hours. The backup server also carries the regular backups strategy: an attacker who can delete backups defeats the recovery the strategy exists for.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : CISA due date for US federal agencies
- : NVD record last modified
Questions, answered.
Is CVE-2026-105133 exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities Catalog on 14 October 2026 alongside CVE-2026-105134, the command injection it chains with, and the public exploit the NVD record notes.
Which AhsayCBS builds are fixed?
9.15.2.70 for v7 to v9 and 10.3.4.45 for v10, both hotfixes. The first October patch did not close the flaw, so the build number is the test, and the server needs a reboot after the hotfix.
What should a service provider do beyond patching?
Review the backup server's access logs for the period before the hotfix, confirm every client's backup set is intact and restorable, and rotate the credentials the server holds.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2026-105133NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2026-105133EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, CISA lists exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS