Ahsay AhsayCBS API Authentication Bypass Vulnerability (CVE-2026-105133) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAll AhsayCBS installations running versions up to 9.15.2.69 and 10.3.4.44.
Unauthenticated remote attackers can bypass the system password verification logic to gain full administrative access to the backup server.
Immediately upgrade to version 9.15.2.70, 10.3.4.45, or later as per vendor instructions.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Immediate Upgrade: Deploy AhsayCBS v9.15.2.70 or v10.3.4.45 immediately. Verify the version after installation.
- Restrict API Access: Implement strict IP whitelisting for the
/obs/api/endpoints on your edge firewall or WAF. - Monitor Logs: Review access logs for unusual activity involving the
checkSysPwdAPI call or unexpected administrative logins.
### WAF Mitigation Strategy
- Block requests to `/obs/api/ApiStructsAction.do` from untrusted IPs.
- Inspect for anomalous `random` parameter values in API requests.Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
The vulnerability exists within the checkSysPwd function of the ApiStructsAction.java file in the AhsayCBS API component. By manipulating the random argument during the authentication handshake, an attacker can trigger an improper authentication state (CWE-287), effectively bypassing the password requirement. This flaw is particularly dangerous as it is listed in the CISA KEV catalog and has an EPSS score of 0.94, indicating widespread active exploitation. Note that the initial vendor patch was insufficient, necessitating a secondary update to fully close the security gap.
Official Vendor Advisories & References
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.