{"id":"CVE-2026-105133","state":"PUBLISHED","title":"Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication","description":"A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.","publishedAt":"2026-10-04T05:15:14.561Z","updatedAt":"2026-10-26T14:31:10.237Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A","source":"VulDB"},"assigner":"VulDB","products":["Ahsay AhsayCBS"],"affected":[{"vendor":"Ahsay","product":"AhsayCBS","versions":[{"version":"9.15.2.0","status":"affected"},{"version":"9.15.2.1","status":"affected"},{"version":"9.15.2.2","status":"affected"},{"version":"9.15.2.3","status":"affected"},{"version":"9.15.2.4","status":"affected"},{"version":"9.15.2.5","status":"affected"},{"version":"9.15.2.6","status":"affected"},{"version":"9.15.2.7","status":"affected"},{"version":"9.15.2.8","status":"affected"},{"version":"9.15.2.9","status":"affected"},{"version":"9.15.2.10","status":"affected"},{"version":"9.15.2.11","status":"affected"},{"version":"9.15.2.12","status":"affected"},{"version":"9.15.2.13","status":"affected"},{"version":"9.15.2.14","status":"affected"},{"version":"9.15.2.15","status":"affected"},{"version":"9.15.2.16","status":"affected"},{"version":"9.15.2.17","status":"affected"},{"version":"9.15.2.18","status":"affected"},{"version":"9.15.2.19","status":"affected"},{"version":"9.15.2.20","status":"affected"},{"version":"9.15.2.21","status":"affected"},{"version":"9.15.2.22","status":"affected"},{"version":"9.15.2.23","status":"affected"},{"version":"9.15.2.24","status":"affected"},{"version":"9.15.2.25","status":"affected"},{"version":"9.15.2.26","status":"affected"},{"version":"9.15.2.27","status":"affected"},{"version":"9.15.2.28","status":"affected"},{"version":"9.15.2.29","status":"affected"},{"version":"9.15.2.30","status":"affected"},{"version":"9.15.2.31","status":"affected"},{"version":"9.15.2.32","status":"affected"},{"version":"9.15.2.33","status":"affected"},{"version":"9.15.2.34","status":"affected"},{"version":"9.15.2.35","status":"affected"},{"version":"9.15.2.36","status":"affected"},{"version":"9.15.2.37","status":"affected"},{"version":"9.15.2.38","status":"affected"},{"version":"9.15.2.39","status":"affected"},{"version":"9.15.2.40","status":"affected"},{"version":"9.15.2.41","status":"affected"},{"version":"9.15.2.42","status":"affected"},{"version":"9.15.2.43","status":"affected"},{"version":"9.15.2.44","status":"affected"},{"version":"9.15.2.45","status":"affected"},{"version":"9.15.2.46","status":"affected"},{"version":"9.15.2.47","status":"affected"},{"version":"9.15.2.48","status":"affected"},{"version":"9.15.2.49","status":"affected"},{"version":"9.15.2.50","status":"affected"},{"version":"9.15.2.51","status":"affected"},{"version":"9.15.2.52","status":"affected"},{"version":"9.15.2.53","status":"affected"},{"version":"9.15.2.54","status":"affected"},{"version":"9.15.2.55","status":"affected"},{"version":"9.15.2.56","status":"affected"},{"version":"9.15.2.57","status":"affected"},{"version":"9.15.2.58","status":"affected"},{"version":"9.15.2.59","status":"affected"},{"version":"9.15.2.60","status":"affected"},{"version":"9.15.2.61","status":"affected"},{"version":"9.15.2.62","status":"affected"},{"version":"9.15.2.63","status":"affected"},{"version":"9.15.2.64","status":"affected"},{"version":"9.15.2.65","status":"affected"},{"version":"9.15.2.66","status":"affected"},{"version":"9.15.2.67","status":"affected"},{"version":"9.15.2.68","status":"affected"},{"version":"9.15.2.69","status":"affected"},{"version":"10.3.4.0","status":"affected"},{"version":"10.3.4.1","status":"affected"},{"version":"10.3.4.2","status":"affected"},{"version":"10.3.4.3","status":"affected"},{"version":"10.3.4.4","status":"affected"},{"version":"10.3.4.5","status":"affected"},{"version":"10.3.4.6","status":"affected"},{"version":"10.3.4.7","status":"affected"},{"version":"10.3.4.8","status":"affected"},{"version":"10.3.4.9","status":"affected"},{"version":"10.3.4.10","status":"affected"},{"version":"10.3.4.11","status":"affected"},{"version":"10.3.4.12","status":"affected"},{"version":"10.3.4.13","status":"affected"},{"version":"10.3.4.14","status":"affected"},{"version":"10.3.4.15","status":"affected"},{"version":"10.3.4.16","status":"affected"},{"version":"10.3.4.17","status":"affected"},{"version":"10.3.4.18","status":"affected"},{"version":"10.3.4.19","status":"affected"},{"version":"10.3.4.20","status":"affected"},{"version":"10.3.4.21","status":"affected"},{"version":"10.3.4.22","status":"affected"},{"version":"10.3.4.23","status":"affected"},{"version":"10.3.4.24","status":"affected"},{"version":"10.3.4.25","status":"affected"},{"version":"10.3.4.26","status":"affected"},{"version":"10.3.4.27","status":"affected"},{"version":"10.3.4.28","status":"affected"},{"version":"10.3.4.29","status":"affected"},{"version":"10.3.4.30","status":"affected"},{"version":"10.3.4.31","status":"affected"},{"version":"10.3.4.32","status":"affected"},{"version":"10.3.4.33","status":"affected"},{"version":"10.3.4.34","status":"affected"},{"version":"10.3.4.35","status":"affected"},{"version":"10.3.4.36","status":"affected"},{"version":"10.3.4.37","status":"affected"},{"version":"10.3.4.38","status":"affected"},{"version":"10.3.4.39","status":"affected"},{"version":"10.3.4.40","status":"affected"},{"version":"10.3.4.41","status":"affected"},{"version":"10.3.4.42","status":"affected"},{"version":"10.3.4.43","status":"affected"},{"version":"10.3.4.44","status":"affected"},{"version":"9.15.2.70","status":"unaffected"},{"version":"10.3.4.45","status":"unaffected"}],"cpes":["cpe:2.3:a:ahsay:ahsaycbs:*:*:*:*:*:*:*:*"],"modules":["API"]}],"references":["https://vuldb.com/vuln/413350","https://vuldb.com/vuln/413350/cti","https://vuldb.com/cve/CVE-2026-105133","https://vuldb.com/submit/942688","https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","https://www.huntress.com/blog/ahsaycbs-flaws-exploit","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/105xxx/CVE-2026-105133.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-105133","state":"PUBLISHED","datePublished":"2026-10-04T05:15:14.561Z","dateUpdated":"2026-10-26T14:31:10.237Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-10-03T13:13:31.953Z"},"containers":{"cna":{"title":"Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication","descriptions":[{"lang":"en","value":"A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary."}],"affected":[{"vendor":"Ahsay","product":"AhsayCBS","versions":[{"version":"9.15.2.0","status":"affected"},{"version":"9.15.2.1","status":"affected"},{"version":"9.15.2.2","status":"affected"},{"version":"9.15.2.3","status":"affected"},{"version":"9.15.2.4","status":"affected"},{"version":"9.15.2.5","status":"affected"},{"version":"9.15.2.6","status":"affected"},{"version":"9.15.2.7","status":"affected"},{"version":"9.15.2.8","status":"affected"},{"version":"9.15.2.9","status":"affected"},{"version":"9.15.2.10","status":"affected"},{"version":"9.15.2.11","status":"affected"},{"version":"9.15.2.12","status":"affected"},{"version":"9.15.2.13","status":"affected"},{"version":"9.15.2.14","status":"affected"},{"version":"9.15.2.15","status":"affected"},{"version":"9.15.2.16","status":"affected"},{"version":"9.15.2.17","status":"affected"},{"version":"9.15.2.18","status":"affected"},{"version":"9.15.2.19","status":"affected"},{"version":"9.15.2.20","status":"affected"},{"version":"9.15.2.21","status":"affected"},{"version":"9.15.2.22","status":"affected"},{"version":"9.15.2.23","status":"affected"},{"version":"9.15.2.24","status":"affected"},{"version":"9.15.2.25","status":"affected"},{"version":"9.15.2.26","status":"affected"},{"version":"9.15.2.27","status":"affected"},{"version":"9.15.2.28","status":"affected"},{"version":"9.15.2.29","status":"affected"},{"version":"9.15.2.30","status":"affected"},{"version":"9.15.2.31","status":"affected"},{"version":"9.15.2.32","status":"affected"},{"version":"9.15.2.33","status":"affected"},{"version":"9.15.2.34","status":"affected"},{"version":"9.15.2.35","status":"affected"},{"version":"9.15.2.36","status":"affected"},{"version":"9.15.2.37","status":"affected"},{"version":"9.15.2.38","status":"affected"},{"version":"9.15.2.39","status":"affected"},{"version":"9.15.2.40","status":"affected"},{"version":"9.15.2.41","status":"affected"},{"version":"9.15.2.42","status":"affected"},{"version":"9.15.2.43","status":"affected"},{"version":"9.15.2.44","status":"affected"},{"version":"9.15.2.45","status":"affected"},{"version":"9.15.2.46","status":"affected"},{"version":"9.15.2.47","status":"affected"},{"version":"9.15.2.48","status":"affected"},{"version":"9.15.2.49","status":"affected"},{"version":"9.15.2.50","status":"affected"},{"version":"9.15.2.51","status":"affected"},{"version":"9.15.2.52","status":"affected"},{"version":"9.15.2.53","status":"affected"},{"version":"9.15.2.54","status":"affected"},{"version":"9.15.2.55","status":"affected"},{"version":"9.15.2.56","status":"affected"},{"version":"9.15.2.57","status":"affected"},{"version":"9.15.2.58","status":"affected"},{"version":"9.15.2.59","status":"affected"},{"version":"9.15.2.60","status":"affected"},{"version":"9.15.2.61","status":"affected"},{"version":"9.15.2.62","status":"affected"},{"version":"9.15.2.63","status":"affected"},{"version":"9.15.2.64","status":"affected"},{"version":"9.15.2.65","status":"affected"},{"version":"9.15.2.66","status":"affected"},{"version":"9.15.2.67","status":"affected"},{"version":"9.15.2.68","status":"affected"},{"version":"9.15.2.69","status":"affected"},{"version":"10.3.4.0","status":"affected"},{"version":"10.3.4.1","status":"affected"},{"version":"10.3.4.2","status":"affected"},{"version":"10.3.4.3","status":"affected"},{"version":"10.3.4.4","status":"affected"},{"version":"10.3.4.5","status":"affected"},{"version":"10.3.4.6","status":"affected"},{"version":"10.3.4.7","status":"affected"},{"version":"10.3.4.8","status":"affected"},{"version":"10.3.4.9","status":"affected"},{"version":"10.3.4.10","status":"affected"},{"version":"10.3.4.11","status":"affected"},{"version":"10.3.4.12","status":"affected"},{"version":"10.3.4.13","status":"affected"},{"version":"10.3.4.14","status":"affected"},{"version":"10.3.4.15","status":"affected"},{"version":"10.3.4.16","status":"affected"},{"version":"10.3.4.17","status":"affected"},{"version":"10.3.4.18","status":"affected"},{"version":"10.3.4.19","status":"affected"},{"version":"10.3.4.20","status":"affected"},{"version":"10.3.4.21","status":"affected"},{"version":"10.3.4.22","status":"affected"},{"version":"10.3.4.23","status":"affected"},{"version":"10.3.4.24","status":"affected"},{"version":"10.3.4.25","status":"affected"},{"version":"10.3.4.26","status":"affected"},{"version":"10.3.4.27","status":"affected"},{"version":"10.3.4.28","status":"affected"},{"version":"10.3.4.29","status":"affected"},{"version":"10.3.4.30","status":"affected"},{"version":"10.3.4.31","status":"affected"},{"version":"10.3.4.32","status":"affected"},{"version":"10.3.4.33","status":"affected"},{"version":"10.3.4.34","status":"affected"},{"version":"10.3.4.35","status":"affected"},{"version":"10.3.4.36","status":"affected"},{"version":"10.3.4.37","status":"affected"},{"version":"10.3.4.38","status":"affected"},{"version":"10.3.4.39","status":"affected"},{"version":"10.3.4.40","status":"affected"},{"version":"10.3.4.41","status":"affected"},{"version":"10.3.4.42","status":"affected"},{"version":"10.3.4.43","status":"affected"},{"version":"10.3.4.44","status":"affected"},{"version":"9.15.2.70","status":"unaffected"},{"version":"10.3.4.45","status":"unaffected"}],"cpes":["cpe:2.3:a:ahsay:ahsaycbs:*:*:*:*:*:*:*:*"],"modules":["API"]}],"references":[{"url":"https://vuldb.com/vuln/413350","name":"VDB-413350 | Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/413350/cti","name":"VDB-413350 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-105133","name":"CVE-2026-105133 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/942688","name":"Submit #942688 | Ahsay Systems Corporation Limited AhsayCBS 10.0.3 Authentication Bypass","tags":["third-party-advisory"]},{"url":"https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","tags":["patch"]},{"url":"https://www.huntress.com/blog/ahsaycbs-flaws-exploit","tags":["broken-link","exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"Improper Authentication"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-10-26T14:31:10.237Z"},"timeline":[{"time":"2026-10-03T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-10-03T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-10-26T15:35:52.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"nickc (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB Vulnerability Moderation Team","type":"coordinator"}],"tags":["x_known-exploited-vulnerability"],"x_generator":["VulDB PVTS v202610"]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133","tags":["government-resource"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-14T00:00:00+00:00","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-105133"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-10-14","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T03:57:04.527Z"},"timeline":[{"time":"2026-10-14T00:00:00.000Z","lang":"en","value":"CVE-2026-105133 added to CISA KEV"}]}]}}}