> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# AhsayCBS CVE-2026-105133: exploited login bypass, how to fix it
- URL: https://stackurity.ai/blog/ahsaycbs-cve-2026-105133-exploited-authentication-bypass/
- Published: 2026-11-07T01:35:04.000Z
- Updated: 2026-11-07T01:35:04.000Z
- Description: CVE-2026-105133 is an exploited authentication bypass in the AhsayCBS backup server. See who is affected, the fixed versions and how to check.
- Author: Stackurity Research Team
- Tags: Actively Exploited, #deep-dive

## TL;DR

- **What:** CVE-2026-105133 is an improper authentication flaw in the API component of AhsayCBS, the backup server from Ahsay. Changing the random parameter of the checkSysPwd function lets a remote attacker get past authentication.
- **Impact:** a remote attacker with no credentials can bypass login on the backup server, which holds copies of your data and the keys to restore it.
- **Severity:** a CVSS v3.1 score of 7.3 (high) from cna@vuldb.com, weakness class CWE-287.
- **Exploited:** yes. CISA added it to the Known Exploited Vulnerabilities catalogue on October 14, 2026, with a due date of October 17, 2026\. It can be chained with CVE-2026-105134.
- **Fix:** upgrade to 9.15.2.70 or 10.3.4.45\. The first patch did not fix the flaw properly, so check servers that were already patched.

## What CVE-2026-105133 is

AhsayCBS is the central server of the Ahsay backup suite. Clients send their backups to it, and administrators use its web console and API to manage users, storage and restores. That makes it a high-value target: whoever controls the backup server can read, change or delete the copies you depend on after an incident.

The National Vulnerability Database describes the flaw as a manipulation of the random argument of the checkSysPwd function, in the API component of AhsayCBS. The result is improper authentication, tracked as CWE-287, and the attack can be started remotely. NVD also says that a public exploit exists and that the first patch did not fix the vulnerability properly, which is why the CVE entry was updated.

That last point is the one most teams miss. If you installed an update when the flaw was first announced, you may still be running a vulnerable release. The reliable test is the version number, not the date of your last patch run.

## Why it matters now

CISA added CVE-2026-105133 to its Known Exploited Vulnerabilities catalogue on October 14, 2026, which means attackers are using it in the wild. The remediation due date for US federal agencies was October 17, 2026, and it has passed. CISA lists known ransomware campaign use as unknown, but a backup server is exactly where ransomware operators look first, because deleting backups raises the pressure to pay.

CISA's entry also says this flaw can be chained with CVE-2026-105134\. A chain means an attacker uses one weakness to open the door for another, so patching only one of them is not enough. The NVD entry for CVE-2026-105133 was published on October 4, 2026 and last modified on October 26, 2026, and its status is Analyzed.

CISA's required action is to apply mitigations in line with the vendor's instructions and to follow its forensics triage guidance. For a server that has been exposed to the internet while vulnerable, patching is the first step and looking for signs of intrusion is the second.

We covered the same pattern, an exploited flaw in a tool that many teams run and rarely look at, in our post on [an exploited Collabora flaw](https://stackurity.ai/blog/collabora-cve-2026-110447-exploited-code-server-rce/) and in the one on [an exploited Atlassian file access flaw](https://stackurity.ai/blog/atlassian-cve-2026-21589-exploited-arbitrary-file-access/).

## Am I affected?

You are affected if you run AhsayCBS on the older release line at a version before 9.15.2.70, or on the newer release line from 10.1.0 up to a version before 10.3.4.45\. A server on or above those versions is outside the affected range. Remember that a backup server is often installed once and then forgotten, so start by finding every one.

To look for AhsayCBS on one Linux machine by hand:

```
ps aux | grep -i ahsay
find / -iname '*ahsay*' 2>/dev/null | head
ss -tlnp | grep -i java
```

The first command shows a running Ahsay process, the second finds installation directories, and the third shows Java services that are listening on the network. Then read the version number in the AhsayCBS management console and compare it with the fixed versions above. On Windows, look in the list of installed programs and in the services list instead.

Do not forget copies in test environments, disaster recovery sites and virtual machine templates. A backup server that nobody remembers is the one that stays vulnerable longest. Also ask who can reach the server: if its web console or API is reachable from the internet, treat it as the most urgent case.

## How to fix CVE-2026-105133

The fix is to move to a release that is not in the affected range. Work through these steps in order:

1. List every AhsayCBS server and record its version, using the checks above and your own records.
2. Upgrade to 9.15.2.70 if you are on the older release line, or to 10.3.4.45 if you are on the newer one, or to a later release. The vendor's patch announcement, which CISA links from its entry, is the place to confirm the current build for your line.
3. If you cannot upgrade at once, take the web console and API off the internet, or restrict them to a management network, until you can. CISA's required action says to stop using the product when no mitigation can be applied.
4. Look for signs of compromise on any server that was reachable while it was vulnerable: unexpected administrator accounts, changes to backup jobs or retention settings, and logins you cannot explain. Rotate the credentials that the server stores or uses.
5. Check again after the change and confirm that no server still reports a version before the fixed ones.

Our guide to [remediation in Stackurity](https://stackurity.ai/docs/remediation) explains how an upgrade is shown with the version to move to and the issues it clears.

## How to check with Stackurity

Stackurity keeps one live inventory of the software on your servers, deployed applications, repositories and container images. A read-only agent on Linux servers reads installed packages, runtimes installed by hand and the libraries that deployed applications actually load. That inventory is matched against new vulnerability advisories and the CISA Known Exploited Vulnerabilities catalogue every hour, and each finding says in one sentence why it applies and is ranked by exploitation, exposure and environment. An entry in the exploited catalogue puts a finding at the top of the list.

After you upgrade, Check again asks the agent for a fresh report and records whether the issue is passed, partly fixed or still open, so you can show the fix worked instead of assuming it. The [verification guide](https://stackurity.ai/docs/verification) describes that step.

Be clear about the limits. On Windows hosts the agent inventories installed programs from a curated catalogue and lists other programs as coverage gaps, so an AhsayCBS server on Windows needs the hand check above. Stackurity does not assess libraries copied into an application outside a package manager or lockfile, and it does not cover network appliance firmware. The core is open source under Apache-2.0, and Stackurity Cloud has a 14-day free trial without a card: [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=actively-exploited&utm%5Fcontent=ahsaycbs-cve-2026-105133-exploited-authentication-bypass).

## FAQ

### Is CVE-2026-105133 being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalogue on October 14, 2026, and set a due date of October 17, 2026\. CISA lists known ransomware campaign use as unknown.

### Which AhsayCBS versions are affected by CVE-2026-105133?

The NVD entry lists releases before 9.15.2.70 on the older release line, and from 10.1.0 before 10.3.4.45 on the newer one. Anything at or above those fixed releases is outside the affected range.

### What is the fixed version for CVE-2026-105133?

Upgrade to 9.15.2.70 or 10.3.4.45, or to a later release on your line. The first patch for this flaw did not fix it properly, so a server that was patched earlier still needs checking against these versions.

### How severe is CVE-2026-105133?

NVD shows a CVSS v3.1 base score of 7.3 (high) from cna@vuldb.com, with a CVSS v4.0 score of 6.9 (medium). The weakness class is CWE-287, improper authentication.

### What is CVE-2026-105134 and how does it relate?

CISA's entry says CVE-2026-105133 can be chained with CVE-2026-105134\. Treat the two as one problem and apply the vendor's patch that covers both.

### Does Stackurity find AhsayCBS?

Stackurity reads installed packages, hand-installed runtimes and the libraries that deployed applications load on Linux servers, and matches them against advisories and the CISA catalogue. Programs on Windows hosts outside its curated catalogue are listed as coverage gaps, so confirm each AhsayCBS server by hand as well.

Sources: [CISA Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search%5Fapi%5Ffulltext=CVE-2026-105133), [NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-105133) and [Stackurity product facts](https://stackurity.ai/llms.txt).