Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication (CVE-2026-105133)

What is affected, what to do

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API.

The vulnerability is being actively exploited; treat it as a priority. Update cloud_backup_suite to version 10.3.4. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• AhsayCBS eq 10.3.0..10.3.0
• AhsayCBS eq 10.3.1..10.3.1
• AhsayCBS eq 10.3.2..10.3.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Find every AhsayCBS instance, including on-prem servers and those hosted by MSPs or backup providers. Confirm the version via the admin console or version.txt in the install directory. All versions up to and including 10.3.2 are affected.
   • Patch: Upgrade to AhsayCBS 10.3.4. The CPE data in the context lists 10.3.4 as "affected", while the CVE description names it as the fixed release. Check the vendor advisory before rollout and deploy the version it confirms as fixed, or the latest available release.
   • Reduce exposure: Until patched, remove direct internet exposure of the AhsayCBS web console and API. The API lives under /obs/api/, usually on web ports 80/443. Restrict access to known client IP ranges or VPN.
   • Treat the chain, not the bug: This flaw chains with CVE-2026-105134. Assess and remediate both together.
   • Rotate credentials: If compromise is suspected, rotate the system admin password (the checkSysPwd context), all admin and sub-admin accounts, API keys, and backup-destination credentials (S3/Azure/Wasabi keys, SFTP).
   • Verify backup integrity: Confirm immutable or offline copies are intact. Check for unauthorised changes to retention policies, backup sets or destinations.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the AhsayCBS server in a dedicated backup zone. Allow admin console access only from a management VLAN or jump hosts. Restrict egress to the defined backup destinations.
   • WAF/reverse proxy: Front AhsayCBS with a reverse proxy. Log requests to /obs/api/* that carry the random parameter and, where operationally feasible, allow them only from approved source IPs. Enforce pre-authentication (mTLS or IdP-backed) in front of the admin UI.
   • IPS rule (Suricata sketch): alert http any any -> $AHSAY_SERVERS any (msg:"AhsayCBS checkSysPwd random param"; http.uri; content:"/obs/api/"; nocase; content:"random="; nocase; sid:9105133; rev:1;). Tune it against legitimate client traffic.
   • Host hardening: Run the AhsayCBS service (Java/Tomcat) under a non-privileged service account. Block the Java process from spawning shells using EDR or AppLocker/WDAC rules.
   • IAM/least privilege: Keep system admin accounts to a minimum and enable two-factor authentication for the console where supported. Scope backup-destination credentials so they cannot delete data (Object Lock/WORM).
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: Look for API calls to /obs/api/ with a random parameter that are not preceded by a successful login. Also flag unusually long or non-numeric random values and request bursts from a single external IP. SPL sketch: index=web uri_path="/obs/api/*" uri_query="*random=*" | stats count by src_ip, uri_path, status.
   • Application audit: In the AhsayCBS audit and system logs, watch for new admin accounts, password changes, modified backup destinations or retention policies, deleted backup sets, and admin logins from unfamiliar IPs.
   • Process ancestry (Sysmon EID 1 / EDR): Alert when ParentImage is java.exe (or an executable in the AhsayCBS bin directory) and Image is cmd.exe, powershell.exe or rundll32.exe. On Linux, use auditd execve events with parent java and exe set to /bin/sh or /bin/bash. This matters most for the CVE-2026-105134 chain.
   • File system (Sysmon EID 11 / auditd): New .jsp, .class or .jar files in AhsayCBS webapp or lib directories indicate a possible webshell.
   • Network (Zeek/Suricata): Watch for unexpected outbound connections from the backup server to non-approved destinations, and for large transfers outside backup windows.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

Source: cvelistv5, NVD (NIST), CISA KEV Catalog

Weakness classes (CWE)

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

References & sources

• vuldb.comVDB-413350 | Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authenticationVulnerability database, Technical description
• vuldb.comVDB-413350 | CTI Indicators (IOB, IOC, IOA)signature, Permissions required
• vuldb.comCVE-2026-105133 | CVE Analysis and ReportThird-party advisory
• vuldb.comSubmit #942688 | Ahsay Systems Corporation Limited AhsayCBS 10.0.3 Authentication BypassThird-party advisory
• ahsay.comen/support/help-centre/release-notes/cbs/v10.3.4Patch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1051…government-resource

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. Initial Analysis15.10.2026nvd@nist.gov

   • CPE Configuration: after OR *cpe:2.3:a:ahsay:cloud_backup_suite:*:*:*:*:*:*:*:* versions up to (excluding) 10.3.4
   • Reference Type: after VulDB: https://vuldb.com/cve/CVE-2026-105133 Types: Third Party Advisory, VDB Entry
   • Reference Type: after VulDB: https://vuldb.com/submit/942688 Types: Third Party Advisory, VDB Entry
   • Reference Type: after VulDB: https://vuldb.com/vuln/413350 Types: Third Party Advisory, VDB Entry

2. CVE Modified15.10.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • SSVC: before {"id":"CVE-2026-105133","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"techni…
   • SSVC: after {"id":"CVE-2026-105133","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"techni…

3. CVE CISA KEV Update14.10.20269119a7d8-5eab-497f-8521-727c672e3725

   • Date Added: after 2026-10-14
   • Due Date: after 2026-10-14
   • Required Action: after 2026-10-14
   • Vulnerability Name: after 2026-10-14

4. CVE Modified14.10.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • Reference: after https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
   • SSVC: before {"id":"CVE-2026-105133","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technica…
   • SSVC: after {"id":"CVE-2026-105133","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"techni…

5. CVE Modified05.10.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • SSVC: after {"id":"CVE-2026-105133","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technica…

Linked advisories

• AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete PatchesThe Hacker News15.10.2026
• NCSC-2026-0427 [1.00] [M/H] Kwetsbaarheden verholpen in Ahsay AhsayCBSNCSC-NL14.10.2026
• Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft EdgeThe Hacker News09.10.2026
• Unpatched AhsayCBS Vulnerabilities Exploited in the WildSecurityWeek09.10.2026