Vulnerability Intelligence Report
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
CVE-2026-105133
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Automatable
Authentication Bypass
CVSS Base Score
6.9
MEDIUM
EPSS Probability:79.24%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-287 ↗Improper Authentication
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Ahsay | AhsayCBS | 9.15.2.0 (affected), 9.15.2.1 (affected), 9.15.2.2 (affected), 9.15.2.3 (affected), 9.15.2.4 (affected), 9.15.2.5 (affected), 9.15.2.6 (affected), 9.15.2.7 (affected), 9.15.2.8 (affected), 9.15.2.9 (affected), 9.15.2.10 (affected), 9.15.2.11 (affected), 9.15.2.12 (affected), 9.15.2.13 (affected), 9.15.2.14 (affected), 9.15.2.15 (affected), 9.15.2.16 (affected), 9.15.2.17 (affected), 9.15.2.18 (affected), 9.15.2.19 (affected), 9.15.2.20 (affected), 9.15.2.21 (affected), 9.15.2.22 (affected), 9.15.2.23 (affected), 9.15.2.24 (affected), 9.15.2.25 (affected), 9.15.2.26 (affected), 9.15.2.27 (affected), 9.15.2.28 (affected), 9.15.2.29 (affected), 9.15.2.30 (affected), 9.15.2.31 (affected), 9.15.2.32 (affected), 9.15.2.33 (affected), 9.15.2.34 (affected), 9.15.2.35 (affected), 9.15.2.36 (affected), 9.15.2.37 (affected), 9.15.2.38 (affected), 9.15.2.39 (affected), 9.15.2.40 (affected), 9.15.2.41 (affected), 9.15.2.42 (affected), 9.15.2.43 (affected), 9.15.2.44 (affected), 9.15.2.45 (affected), 9.15.2.46 (affected), 9.15.2.47 (affected), 9.15.2.48 (affected), 9.15.2.49 (affected), 9.15.2.50 (affected), 9.15.2.51 (affected), 9.15.2.52 (affected), 9.15.2.53 (affected), 9.15.2.54 (affected), 9.15.2.55 (affected), 9.15.2.56 (affected), 9.15.2.57 (affected), 9.15.2.58 (affected), 9.15.2.59 (affected), 9.15.2.60 (affected), 9.15.2.61 (affected), 9.15.2.62 (affected), 9.15.2.63 (affected), 9.15.2.64 (affected), 9.15.2.65 (affected), 9.15.2.66 (affected), 9.15.2.67 (affected), 9.15.2.68 (affected), 9.15.2.69 (affected), 10.3.4.0 (affected), 10.3.4.1 (affected), 10.3.4.2 (affected), 10.3.4.3 (affected), 10.3.4.4 (affected), 10.3.4.5 (affected), 10.3.4.6 (affected), 10.3.4.7 (affected), 10.3.4.8 (affected), 10.3.4.9 (affected), 10.3.4.10 (affected), 10.3.4.11 (affected), 10.3.4.12 (affected), 10.3.4.13 (affected), 10.3.4.14 (affected), 10.3.4.15 (affected), 10.3.4.16 (affected), 10.3.4.17 (affected), 10.3.4.18 (affected), 10.3.4.19 (affected), 10.3.4.20 (affected), 10.3.4.21 (affected), 10.3.4.22 (affected), 10.3.4.23 (affected), 10.3.4.24 (affected), 10.3.4.25 (affected), 10.3.4.26 (affected), 10.3.4.27 (affected), 10.3.4.28 (affected), 10.3.4.29 (affected), 10.3.4.30 (affected), 10.3.4.31 (affected), 10.3.4.32 (affected), 10.3.4.33 (affected), 10.3.4.34 (affected), 10.3.4.35 (affected), 10.3.4.36 (affected), 10.3.4.37 (affected), 10.3.4.38 (affected), 10.3.4.39 (affected), 10.3.4.40 (affected), 10.3.4.41 (affected), 10.3.4.42 (affected), 10.3.4.43 (affected), 10.3.4.44 (affected), 9.15.2.70 (unaffected), 10.3.4.45 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
79.236%
GitHub Advisory
Vulnerability Class
Authentication Bypass
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulDB · Researcher · Switzerland |
| Reserved | 2026-10-03T13:13:31 |
| Published | 2026-10-04T05:15:14 |
| Last Updated | 2026-10-26T14:31:10 |
Community Chatter & Buzz