Summary
generated automatically from NVD dataAhsay AhsayCBS up to version 10.3.2 has an improper authentication flaw (CWE-287) in the checkSysPwd function of com/ahsay/obs/api/ApiStructsAction.java in its API component. Manipulating the random argument lets a remote attacker bypass authentication, with possible low impact on confidentiality, integrity and availability. The flaw is listed in the CISA KEV catalog and rated 7.3 (HIGH, CVSS v3.1); the NVD description states that upgrading to version 10.3.4 mitigates it.
NVD description
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-14. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-10-17
EPSS · FIRST.org
0.85%probability of exploitation in the next 30 days
Higher than 57% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 4 oct. 2026
- Updated
- 15 oct. 2026
- Status
- Analyzed
- Source
- cna@vuldb.com
Affected products
Weaknesses (CWE)
References (6)
- https://vuldb.com/cve/CVE-2026-105133Third Party AdvisoryVDB Entry
- https://vuldb.com/submit/942688Third Party AdvisoryVDB Entry
- https://vuldb.com/vuln/413350Third Party AdvisoryVDB Entry
- https://vuldb.com/vuln/413350/ctiPermissions RequiredVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-287
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.