CVE-2026-105133

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.058 · 93 %ileexploit · PoCNLUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 1 exploit · PoC

Likely / severe?

5.79% (93rd) EPSS

CVSS 7.3 · high

Is it mine?

2 products

Check your exposure

Who says so?

2 sources

ncsc_nl · nvd

added 2026-10-14remediate by 2026-10-17

required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

EPSS · scored 2026-10-23

Ahsay AhsayCBS Improper Authentication Vulnerability

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.5–7.5

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lprimary · cna@vuldb.comexploitability 3.9 · impact 3.4

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Psecondary · cna@vuldb.comexploitability 10 · impact 6.4

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · NCSC-NL NL

v4.05.5mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cna@vuldb.com

v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287US

exploits (1)

Public proof-of-concept and weaponised exploit code.

horizon3ai/AhsayCBS-Auth-Bypass-RCEA proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBSPoC · poc_in_github

affected products (2)

Products and version ranges known to be affected.

Ahsay AhsayCBS≤ vers:unknown/*ncsc_nlNL
ahsay cloud backup suite< 10.3.4nvdUScpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

NCSC-2026-0427Kwetsbaarheden verholpen in Ahsay AhsayCBSNL2026-10-14csaf · ncsc_nlNL
Ahsay heeft kwetsbaarheden verholpen in AhsayCBS tot en met versie 10.3.2.

sources

Which sources assert this record, and when.

ncsc_nl nvd NVD CVE.org MITRE

published 2026-10-04modified 2026-10-15

references (6) nvd

External citations — patches, advisories, analysis.

https://vuldb.com/cve/CVE-2026-105133Third Party AdvisoryVDB Entry
https://vuldb.com/submit/942688Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/413350Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/413350/ctiPermissions RequiredVDB Entry
https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133US Government Resource

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan