ZeroDayAlert

CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.

Ahsay AhsayCBS Added to KEV 2026-10-14 Federal due 2026-10-17 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Ahsay AhsayCBS is a backup and disaster recovery platform. The vulnerability exists in the API component's authentication mechanism and affects the product's ability to verify user identity. The record does not specify which versions of AhsayCBS are vulnerable or whether the flaw affects only cloud-hosted instances, on-premises deployments, or both.

How to check whether this touches you

  • Inventory your backup and disaster recovery tooling: confirm whether you run any Ahsay product, and specifically AhsayCBS.
  • Establish whether any AhsayCBS instance is reachable from an untrusted network (the internet, guest WiFi, or partner VPNs); check firewall rules, WAF logs, and reverse proxy configurations.
  • Attempt to fingerprint the running version using the product's administrative interface, API version endpoints, or banner grabbing; version number is a signal but not definitive proof of patch status, as backported fixes exist.
  • Review Ahsay's security advisory and your support contract to confirm which versions and configurations require patching.

What to do

  1. Contact Ahsay support immediately to obtain the required patch and verify the remediation timeline for your deployed version and configuration.
  2. Until patching is complete, restrict network access to AhsayCBS API endpoints to known, trusted source IP addresses only; use firewall rules, VPN gating, or authentication proxies to enforce this.
  3. Enable and review API authentication logs, looking for failed authentication attempts, unusual parameter values in checkSysPwd function calls, or requests from unexpected sources; retain logs for at least 90 days.
  4. If the product runs in a cloud environment and Ahsay cannot provide a patch within your risk tolerance, follow CISA BOD 26-04 guidance and prepare to discontinue the service.
  5. Escalate to your information security team if the instance is internet-facing or processes critical backup data, or if you cannot apply mitigations within the federal remediation due date (2026-10-17).

If you find you were exposed

Exploitation of authentication bypasses typically occurs before public disclosure; review AhsayCBS audit logs and API access logs for the 90 days preceding the public notification date to identify suspicious authentication patterns or API calls that succeeded without valid credentials. Cross-reference API access logs with your identity and access management system to identify any logins that lack corresponding user records or session initiations. Retain these logs for forensic analysis and check whether any backup or restore operations were initiated or completed by unauthorised accounts during the exposure window.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-105133 is being exploited. It cannot tell you whether AhsayCBS is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →