Read the docs
TI-2026-67514 Aliases CVE-2026-105133GHSA-fp2j-3cmp-828j

Improper authentication in Ahsay AhsayCBS API

Priority CRITICAL 88Exploited in the wildCWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Ahsay AhsayCBS up to 9.15.2.69 and up to 10.3.4.44 contain an improper authentication flaw (CWE-287) in the checkSysPwd function of the API. Manipulating the random argument lets a remote attacker bypass authentication, and the initial patch did not fully fix the flaw. A public exploit exists, and the flaw is listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-14CISA due date 2026-10-17
EPSS 0.84478 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed AhsayCBS (Ahsay): 9.15.2.70, 10.3.4.45

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AhsayAhsayCBS9.15.2.0; 9.15.2.1; 9.15.2.2; 9.15.2.3; 9.15.2.4; 9.15.2.5; 9.15.2.6; 9.15.2.7; 9.15.2.8; 9.15.2.9; 9.15.2.10; 9.15.2.11; 9.15.2.12; 9.15.2.13; 9.15.2.14; 9.15.2.15; 9.15.2.16; 9.15.2.17; 9.15.2.18; 9.15.2.19; 9.15.2.20; 9.15.2.21; 9.15.2.22; 9.15.2.23; 9.15.2.24; 9.15.2.25; 9.15.2.26; 9.15.2.27; 9.15.2.28; 9.15.2.29; 9.15.2.30; 9.15.2.31; 9.15.2.32; 9.15.2.33; 9.15.2.34; 9.15.2.35; 9.15.2.36; 9.15.2.37; 9.15.2.38; 9.15.2.39; 9.15.2.40; 9.15.2.41; 9.15.2.42; 9.15.2.43; 9.15.2.44; 9.15.2.45; 9.15.2.46; 9.15.2.47; 9.15.2.48; 9.15.2.49; 9.15.2.50; 9.15.2.51; 9.15.2.52; 9.15.2.53; 9.15.2.54; 9.15.2.55; 9.15.2.56; 9.15.2.57; 9.15.2.58; 9.15.2.59; 9.15.2.60; 9.15.2.61; 9.15.2.62; 9.15.2.63; 9.15.2.64; 9.15.2.65; 9.15.2.66; 9.15.2.67; 9.15.2.68; 9.15.2.69; 10.3.4.0; 10.3.4.1; 10.3.4.2; 10.3.4.3; 10.3.4.4; 10.3.4.5; 10.3.4.6; 10.3.4.7; 10.3.4.8; 10.3.4.9; 10.3.4.10; 10.3.4.11; 10.3.4.12; 10.3.4.13; 10.3.4.14; 10.3.4.15; 10.3.4.16; 10.3.4.17; 10.3.4.18; 10.3.4.19; 10.3.4.20; 10.3.4.21; 10.3.4.22; 10.3.4.23; 10.3.4.24; 10.3.4.25; 10.3.4.26; 10.3.4.27; 10.3.4.28; 10.3.4.29; 10.3.4.30; 10.3.4.31; 10.3.4.32; 10.3.4.33; 10.3.4.34; 10.3.4.35; 10.3.4.36; 10.3.4.37; 10.3.4.38; 10.3.4.39; 10.3.4.40; 10.3.4.41; 10.3.4.42; 10.3.4.43; 10.3.4.449.15.2.70, 10.3.4.45Patch availableCNA
  • AhsayCBS VendorAhsay Affected 9.15.2.0; 9.15.2.1; 9.15.2.2; 9.15.2.3; 9.15.2.4; 9.15.2.5; 9.15.2.6; 9.15.2.7; 9.15.2.8; 9.15.2.9; 9.15.2.10; 9.15.2.11; 9.15.2.12; 9.15.2.13; 9.15.2.14; 9.15.2.15; 9.15.2.16; 9.15.2.17; 9.15.2.18; 9.15.2.19; 9.15.2.20; 9.15.2.21; 9.15.2.22; 9.15.2.23; 9.15.2.24; 9.15.2.25; 9.15.2.26; 9.15.2.27; 9.15.2.28; 9.15.2.29; 9.15.2.30; 9.15.2.31; 9.15.2.32; 9.15.2.33; 9.15.2.34; 9.15.2.35; 9.15.2.36; 9.15.2.37; 9.15.2.38; 9.15.2.39; 9.15.2.40; 9.15.2.41; 9.15.2.42; 9.15.2.43; 9.15.2.44; 9.15.2.45; 9.15.2.46; 9.15.2.47; 9.15.2.48; 9.15.2.49; 9.15.2.50; 9.15.2.51; 9.15.2.52; 9.15.2.53; 9.15.2.54; 9.15.2.55; 9.15.2.56; 9.15.2.57; 9.15.2.58; 9.15.2.59; 9.15.2.60; 9.15.2.61; 9.15.2.62; 9.15.2.63; 9.15.2.64; 9.15.2.65; 9.15.2.66; 9.15.2.67; 9.15.2.68; 9.15.2.69; 10.3.4.0; 10.3.4.1; 10.3.4.2; 10.3.4.3; 10.3.4.4; 10.3.4.5; 10.3.4.6; 10.3.4.7; 10.3.4.8; 10.3.4.9; 10.3.4.10; 10.3.4.11; 10.3.4.12; 10.3.4.13; 10.3.4.14; 10.3.4.15; 10.3.4.16; 10.3.4.17; 10.3.4.18; 10.3.4.19; 10.3.4.20; 10.3.4.21; 10.3.4.22; 10.3.4.23; 10.3.4.24; 10.3.4.25; 10.3.4.26; 10.3.4.27; 10.3.4.28; 10.3.4.29; 10.3.4.30; 10.3.4.31; 10.3.4.32; 10.3.4.33; 10.3.4.34; 10.3.4.35; 10.3.4.36; 10.3.4.37; 10.3.4.38; 10.3.4.39; 10.3.4.40; 10.3.4.41; 10.3.4.42; 10.3.4.43; 10.3.4.44 Fixed in 9.15.2.70, 10.3.4.45 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*before 9.15.2.70; 10.1.0 to before 10.3.4.45VulnerableAhsay
  • cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:* Versions before 9.15.2.70; 10.1.0 to before 10.3.4.45 Vulnerable ·Ahsay

Remediation

Upgrade AhsayCBS to 9.15.2.70 or 10.3.4.45. CISA requires U.S. federal agencies to fix it by 2026-10-17.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA AhsayCBS (Ahsay) Fixed in 9.15.2.70, 10.3.4.45

Timeline

  1. 2026-10-04 Threatist record created from CVE-2026-105133
  2. 2026-10-04 Priority changed: MEDIUM → LOW
  3. 2026-10-04 Alias added: GHSA-fp2j-3cmp-828j
  4. 2026-10-05 CISA SSVC decision points changed
  5. 2026-10-14 Added to CISA KEV
  6. 2026-10-15 Priority changed: LOW → CRITICAL
  7. 2026-10-15 CISA SSVC decision points changed
  8. 2026-10-16 EPSS moved to the 50th–90th percentile
  9. 2026-10-23 EPSS moved to the 90th–95th percentile
  10. 2026-10-25 EPSS moved to the 99th percentile and above
  11. 2026-10-26 CVSS score changed · CNA
  12. 2026-10-26 Fix available: Ahsay/[email protected], Ahsay/[email protected] · CNA
  13. 2026-10-26 2 new references · CNA

References

Exploit 1

Patch 1

  • TI-2026-67515 OS command injection in Ahsay AhsayCBS Replication Receiver KEVCVSS 4.0CRITICAL 10.0
  • TI-2019-07579 An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup… CVSS 3.0HIGH 8.8
  • TI-2022-17231 Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM… CVSS 3.1HIGH 7.2
  • TI-2019-07578 An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. CVSS 3.0HIGH 7.5
  • TI-2020-04766 An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup… CVSS 3.1HIGH 8.8
  • TI-2019-07577 An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. CVSS 3.0HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences