CVE-2026-105133: listed in the CISA KEV catalog

CVE-2026-105133 · CVSS 7.3 HIGH · EPSS 1% · KEV 2026-10-14 · patch available

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

Is CVE-2026-105133 exploited?

• Listed in the CISA KEV catalog on 2026-10-14.
• Federal remediation due 2026-10-17.
• EPSS puts exploitation in the next 30 days at 1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Ahsay · AhsayCBS · 10.3.0, 10.3.1, 10.3.2

Is there a patch?

• AhsayCBS 10.3.4

What PlainSec published about CVE-2026-105133

• CISA puts firewall, mail, and backup flaws on clock (2026-10-15)
• AhsayCBS flaws now drive web shells and miners (2026-10-02)

Primary sources

• NVD record
• CISA KEV catalog

KEV and EPSS are re-checked daily. Record last updated 2026-10-15.