# CVE-2026-105133: Ahsay AhsayCBS authentication bypass in API

Source: https://junglewise.ai/threats/cve-2026-105133-a-vulnerability-was-detected-in-ahsay-ahsaycbs-up-to-10-3-2-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-04. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105133 · Severity: critical · CVSS 7.3 · Exploited in the wild · Published 2026-10-04

Ahsay AhsayCBS is a cloud backup and archival platform used by enterprises to protect data. A vulnerability in its API authentication function allows remote attackers to bypass authentication by manipulating a random parameter, potentially gaining unauthorized access to backup systems and stored data without valid credentials.

## Quick answers

**Is CVE-2026-105133 exploited in the wild?** Yes. CVE-2026-105133 is known to be exploited in the wild, first recorded on 14 October 2026. Treat it as urgent.

**How severe is CVE-2026-105133?** Critical severity, with a CVSS score of 7.3, published 4 October 2026.

**Which products and versions are affected?** AhsayCBS up to 10.3.2.

**Is there a fix for CVE-2026-105133?** Yes: fixed in 10.3.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105133 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105133?** Check whether you run AhsayCBS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.3.4

## Technical details

The checkSysPwd function in the API component (com/ahsay/obs/api/ApiStructsAction.java) improperly validates the random parameter during authentication, allowing attackers to bypass access controls remotely. No authentication or user interaction is required to exploit this issue. The vulnerability has a public exploit available.

## Affected products

- Ahsay AhsayCBS up to 10.3.2

## Timeline

- 2026-10-04: disclosed

## References

- [https://vuldb.com/cve/CVE-2026-105133](https://vuldb.com/cve/CVE-2026-105133)
- [https://vuldb.com/submit/942688](https://vuldb.com/submit/942688)

## Related threats

- [Ahsay AhsayCBS OS command injection in UpdateReceivers](https://junglewise.ai/threats/cve-2026-105134-a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-10-3-2-this)