Detections
Analytics

Ahsay AhsayCBS < 10.3.4.45 Authentication Bypass

critical Web App Scanning Plugin ID 115714

Synopsis

Ahsay AhsayCBS < 10.3.4.45 Authentication Bypass

Description

The Ahsay AhsayCBS backup server running on the remote host is affected by an improper authentication vulnerability. The flaw resides in the checkSysPwd function of com/ahsay/obs/api/ApiStructsAction.java within the API component. By manipulating the random argument supplied to this function, an unauthenticated, remote attacker can bypass authentication checks without any user interaction. This vulnerability can be chained with CVE-2026-105134 (an OS command injection in the Replication Receiver component) to achieve unauthenticated remote code execution.

Solution

Upgrade to Ahsay AhsayCBS version 10.3.4.45 or later.

See Also

https://www.huntress.com/blog/ahsaycbs-flaws-exploit

Plugin Details

Severity: Critical

ID: 115714

Type: Check Based

Published: 10/15/2026

Updated: 10/16/2026

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

Percentile: 99.87

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-105134

CVSS v3

Risk Factor: Critical

Base Score: 10

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS Score Source: CVE-2026-105134

CVSS v4

Risk Factor: Critical

Base Score: 10

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS Score Source: CVE-2026-105134

Vulnerability Information

CPE: cpe:2.3:a:ahsay:ahsaycbs:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/10/2026

Vulnerability Publication Date: 10/2/2026

CISA Known Exploited Vulnerability Due Dates: 10/17/2026

Reference Information

CVE: CVE-2026-105133, CVE-2026-105134