ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 2h Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 5h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 8h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 8h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 9h Vulnerability in Sparx Systems Enterprise Architect software · 9h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 9h Vulnerabilities in Slican telephone exchanges · 10h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 13h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 14h ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 2h Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 5h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 8h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 8h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 9h Vulnerability in Sparx Systems Enterprise Architect software · 9h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 9h Vulnerabilities in Slican telephone exchanges · 10h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 13h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 14h
🛡️
ACyber Sentinel Security Assessment Team
← Back to feed
🇬🇧 English 🇮🇷 فارسی 🇸🇦 العربية 🇷🇺 Русский 🇨🇳 中文 🏛️ Latina
⚠️ Vulnerability Report

CVE-2026-105133

HIGH CVSS 7.5 CVSS 2.0 📌 Undergoing Analysis

CVE-2026-105133 - Ahsay AhsayCBS Improper Authentication Vulnerability - [Actively Exploited]

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

Published: Oct 04, 2026 07:16

Last Modified: Oct 15, 2026 04:18

More from CVE-2026-105133

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors ...

📰 The Hacker News 🕐 14h
Ahsay komt met update voor actief misbruikt lek in Cloud Backup Server

Ahsay komt met update voor actief misbruikt lek in Cloud Backup Server

Softwareontwikkelaar Ashay heeft een hotfix uitgebracht voor een kwetsbaarheid waar aanvallers al zeker sinds 4 oktober misbruik van maken. ...

📰 security.nl 🕐 1d
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testi...

📰 The Hacker News 🕐 3d
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices...

📰 The Hacker News 🕐 6d
Organisaties gehackt via kritiek lek in Ahsay Cloud Backup Server

Organisaties gehackt via kritiek lek in Ahsay Cloud Backup Server

Aanvallers maken actief misbruik van twee kwetsbaarheden in Ahsay Cloud Backup Server (CBS) voor het hacken van organisaties en beveiligings...

📰 security.nl 🕐 6d
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Acknowledgements: Special thanks to Dipo Rodipe, John Hammond, Susannah Matt, Ben Nahorney, and Lindsey Welch for their contributions to thi...

📰 Huntress 🕐 Oct 08