Zero Radar
← feed
CriticalVulnerabilityCVE-2026-105133updated 26 Oct 2026, 15:17 UTC

Ahsay AhsayCBS backup server can be logged into without a password

Attackers on the internet can trick the backup server into letting them in without valid credentials. Anyone who gets in can view or change the backup data it holds.

Exploited (CISA KEV, NVD)Fix availableOfficial, 3 sources
SeverityCriticalCVSS 6.9 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 14 Oct 2026
Fix available?YesUpgrade to 9.15.2.70 (9.15 branch) or 10.3.4.45 (10.3 branch). The initial patch was incomplete, so use these later builds. GitHub Advisory cites 10.3.4 as the fix. · since 25 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerTargets internet-reachable server
  2. 2Crafted API requestManipulates the 'random' parameter
  3. 3checkSysPwd bypassedAuthentication check is skipped
  4. 4Backup accessAttacker reaches stored backup data
  5. ResultAttacker gains unauthorized access to backups

What happened

The checkSysPwd function in the API component (ApiStructsAction.java) of Ahsay AhsayCBS mishandles the 'random' argument, causing improper authentication that can be triggered remotely. The flaw can be chained with CVE-2026-105134.

Why it is dangerous: A successful attacker can bypass login on a backup system, potentially exposing or altering backed-up data of every customer or company using it. Internet-facing installations are most at risk, and CISA confirms active exploitation.

Are you affected?

You are affected if you run Ahsay AhsayCBS up to 9.15.2.69 or 10.3.2 to 10.3.4.44, especially if the server is reachable from the internet.

Ahsay AhsayCBS up to 9.15.2.69 and up to 10.3.4.44 (per NVD); up to 10.3.2 (per GitHub Advisory).

What to do

  1. Upgrade AhsayCBS to 10.3.4.45 or later, or 9.15.2.70 or later if you are on the 9.15 branch
  2. If you cannot upgrade immediately, restrict access to the AhsayCBS server from the internet
  3. Review logs for unauthorized logins and suspicious API requests
  4. Follow CISA BOD 26-04 forensic triage guidance if compromise is suspected

Timeline

  1. 4 Oct 2026, 07:16 UTC
    Publicly disclosed
  2. 14 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:35 UTC
    Fix: Upgrade to Ahsay AhsayCBS 10.3.4 or later.
  5. 26 Oct 2026, 15:17 UTC
    NVD reported on it · NVD

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-105133 · GHSA-fp2j-3cmp-828j
CVSS
6.9 / 10
EPSS
79% chance of exploitation within 30 days
Disclosed
4 Oct 2026, 07:16 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 15:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Ahsay AhsayCBS backup server can be logged into without a password · Zero Radar