AhsayCBS authentication bypass added to CISA KEV (CVE-2026-105133)

CISA added an improper authentication flaw in Ahsay AhsayCBS, tracked as CVE-2026-105133, to its Known Exploited Vulnerabilities (KEV) catalog on 14 October 2026, which means exploitation has been observed. Federal agencies must apply mitigations by 17 October 2026, and any organisation running an exposed AhsayCBS server should treat that as its own deadline. The CISA KEV entry says the bug can be chained with CVE-2026-105134.

What happened

AhsayCBS is Ahsay’s backup server software. According to the NVD description, the flaw sits in the checkSysPwd function of the API component. Manipulating the random argument results in improper authentication, so a remote attacker can bypass the login check. The NVD record also says a public exploit exists.

CISA’s catalog entry names the issue “Ahsay AhsayCBS Improper Authentication Vulnerability”. Whether it is used in ransomware campaigns is listed as unknown. Details of the exploitation seen in the wild have not been disclosed.

Is AhsayCBS affected? Am I affected?

• Ahsay AhsayCBS up to version 10.3.2 is named as affected in the NVD description.
• Version 10.3.4 is the release the NVD text says mitigates the issue, with the fix noted in the 10.3.4 release notes.
• Releases between the affected range and the fixed release are not addressed in the data we have, so confirm your exact build with Ahsay rather than assuming it is safe.
• Structured affected-product data was not available in the NVD record at the time of writing.

Technical details

• Weakness: CWE-287, improper authentication.
• Attack vector: remote over the network, no privileges or user interaction needed per the CVSS 4.0 vector.
• CVSS 4.0 base score: 5.5 (medium). That score understates the practical urgency, because the flaw is confirmed exploited and an exploit is public.
• KEV: added 14 October 2026, due date 17 October 2026.
• EPSS: 0.00383, a low modelled probability. EPSS is a prediction and KEV is evidence of real exploitation, so KEV should win when they disagree.
• Related flaw: CISA says this can be chained with CVE-2026-105134.

Why this matters

Analysis, not new facts: backup servers hold copies of an organisation’s data and often hold credentials for the systems they protect. An authentication bypass on that kind of service is attractive even with a medium base score. A chain with a second flaw could raise the impact beyond what this one score suggests, although the specific outcome of the chain has not been disclosed.

If the server is reachable from the internet, plan to upgrade within hours, not the usual patch cycle. Internal-only servers are lower risk but still deserve the upgrade this week.

Detection and hunting ideas

No indicators of compromise were published in the sources we reviewed, so detection has to rely on behaviour. These ideas follow from the facts above and are suggestions, not confirmed attacker behaviour.

• Look in web and API logs for requests to the API component that carry unusual or repeated values in the random parameter.
• Alert on successful administrative access that has no matching normal login event, especially from external addresses.
• Review backup job changes, new users, changed schedules and deleted backup sets since early October 2026, when the CVE was first published.
• Check for outbound connections from the backup server to hosts it does not normally contact.

What to do

1. Inventory every AhsayCBS instance and record its version and whether the management interface is reachable from the internet.
2. Upgrade to version 10.3.4 or later, following Ahsay’s release notes.
3. Also check and remediate CVE-2026-105134, since CISA says the two can be chained.
4. Restrict access to the AhsayCBS web and API interfaces to trusted networks or a VPN until the upgrade is complete.
5. If mitigations are not available for your deployment, CISA’s required action says to discontinue use of the product. Follow the BOD 26-04 guidance it references.
6. Hunt for compromise: review API and authentication logs for unusual requests to the API component and unexpected logins or new accounts. No indicators of compromise have been published in the sources we reviewed.

Related coverage

• Ivanti Connect Secure auth bypass added to CISA KEV (CVE-2026-104935)
• Cisco Secure Email Gateway path traversal added to CISA KEV (CVE-2026-76519)
• Strapi CVE-2023-22894 data exposure flaw added to CISA KEV catalog

Sources

• CISA Known Exploited Vulnerabilities catalog: CVE-2026-105133
• NVD: CVE-2026-105133
• Ahsay CBS 10.3.4 release notes