Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-105133: Ahsay CBS can let attackers bypass login
CVE-2026-105133 · published 15 days ago · actively exploited
Summary
The Ahsay Cloud Backup Suite’s API can be tricked into accepting a false password check, letting a remote user get in without proper credentials. This could expose your backup data to unauthorized access. Apply the vendor’s security update and limit API access to trusted networks until the fix is installed.
What to do
- Update ahsay cloud_backup_suite to version 10.3.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ahsay | ahsaycbs | 10.3.0 |
| ahsay | cloud_backup_suite |
< 10.3.4 cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:* |
Original advisory text
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
References
- https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4 Release Notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
- https://vuldb.com/vuln/413350 Third Party Advisory VDB Entry
- https://vuldb.com/vuln/413350/cti Permissions Required VDB Entry
- https://vuldb.com/cve/CVE-2026-105133 Third Party Advisory VDB Entry
- https://vuldb.com/submit/942688 Third Party Advisory VDB Entry
Internet-facing
3 days
Internal
14 days
- Known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
<1%
chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published4 Oct 2026
Updated16 Oct 2026
First seen4 Oct 2026
Track software like this
Free during beta