CVE-2026-105133

Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

State: Published
Severity: 6.9 Medium
Published: Oct 4, 2026
Updated: Oct 26, 2026
Reserved: Oct 3, 2026

Description

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C	VulDB

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
AhsayCBSAhsay	9.15.2.0Affected 9.15.2.1Affected 9.15.2.2Affected 9.15.2.3Affected 9.15.2.4Affected 9.15.2.5Affected 9.15.2.6Affected 9.15.2.7Affected 9.15.2.8Affected 9.15.2.9Affected 9.15.2.10Affected 9.15.2.11Affected 9.15.2.12Affected 9.15.2.13Affected 9.15.2.14Affected 9.15.2.15Affected 9.15.2.16Affected 9.15.2.17Affected 9.15.2.18Affected 9.15.2.19Affected 9.15.2.20Affected 9.15.2.21Affected 9.15.2.22Affected 9.15.2.23Affected 9.15.2.24Affected and 92 more versions

Product

Versions

AhsayCBSAhsay

9.15.2.0Affected
9.15.2.1Affected
9.15.2.2Affected
9.15.2.3Affected
9.15.2.4Affected
9.15.2.5Affected
9.15.2.6Affected
9.15.2.7Affected
9.15.2.8Affected
9.15.2.9Affected
9.15.2.10Affected
9.15.2.11Affected
9.15.2.12Affected
9.15.2.13Affected
9.15.2.14Affected
9.15.2.15Affected
9.15.2.16Affected
9.15.2.17Affected
9.15.2.18Affected
9.15.2.19Affected
9.15.2.20Affected
9.15.2.21Affected
9.15.2.22Affected
9.15.2.23Affected
9.15.2.24Affected
and 92 more versions

References

VDB-413350 | Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authenticationvdb-entrytechnical-description
VDB-413350 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-105133 | CVE Analysis and Reportthird-party-advisory
Submit #942688 | Ahsay Systems Corporation Limited AhsayCBS 10.0.3 Authentication Bypassthird-party-advisory
https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-updatepatch
https://www.huntress.com/blog/ahsaycbs-flaws-exploitbroken-linkexploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.