CVE-2026-105133
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
CVSS Score
7.3
EPSS Score
0.4%
EPSS Percentile
31th
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.
| CWE | CWE-287 |
| Vendor | ahsay |
| Product | ahsaycbs |
| Published | Oct 4, 2026 |
| Last Updated | Oct 15, 2026 |
⚠️ Actively Exploited — Act Now
Get instant alerts for ahsay ahsaycbs
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2026-105133.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Ahsay / AhsayCBS
10.3.0 10.3.1 10.3.2
References
vuldb.com: https://vuldb.com/vuln/413350 vuldb.com: https://vuldb.com/vuln/413350/cti vuldb.com: https://vuldb.com/cve/CVE-2026-105133 vuldb.com: https://vuldb.com/submit/942688 ahsay.com: https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4 cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
Credits
🔍 nickc (VulDB User) VulDB Vulnerability Moderation Team