CVE-2026-105133: Improper Authentication in Ahsay AhsayCBS

An authentication vulnerability has been discovered in Ahsay AhsayCBS, a cloud backup system used by enterprises to protect critical data. CVE-2026-105133 resides in the checkSysPwd function of the API and allows an attacker to manipulate the random parameter to bypass authentication control. This means anyone can access the system without providing valid credentials, compromising the integrity of all backups managed by the platform.

The CVSS score of 7.3 places the vulnerability in the HIGH range. The status is critical: the exploit is now public and can be exploited. Recent activity targeting CVE-2026-105133 has been observed. Important note: the initial patch released did not completely resolve the issue, making a subsequent update necessary. Administrators who applied the first patch must update again.

Immediate action is to inventory all instances of Ahsay AhsayCBS in your environment and verify their versions. Upgrade to versions 9.15.2.70 (series 9) or 10.3.4.45 (series 10) is required. In parallel, monitor API logs to detect attempts to manipulate the random parameter. Implement network access controls to limit API access to the backup system to authorized hosts only.