CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability

According to VulDB, the flaw affects Ahsay AhsayCBS up to 10.3.2[2] and lies in the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API[2]. VulDB says the attack can be initiated remotely[2] and that "the exploit is now public."[2]Huntress says NVD disclosed CVE-2026-105133 and CVE-2026-105134 on October 4, 2026[1], and that starting October 7 it saw threat actors exploiting the flaws for remote code execution[1]. By October 8, Huntress said, it had seen five organizations targeted[1].The firm describes the chain this way: CVE-2026-105133 is used to bypass authentication, and CVE-2026-105134 is then used to gain code execution[1]. Huntress says the second flaw can give attackers "unauthenticated remote code execution as NT AUTHORITY/SYSTEM"[1]. Huntress calls CVE-2026-105133 a medium-severity flaw[1], while Strix lists it at 7.3/10 (HIGH severity)[3].Rescana reports that, according to Ahsay, the v10.3.4.0 release "did not fully address"[4] the two CVEs. Huntress says Ahsay released a hotfix on October 12[1] and advises v10 users to apply the AhsayCBS 10.3.4.45 hotfix[1]. Huntress says it has independently verified that the 10.3.4.45 hotfix mitigates the initial entry point[1], while Rescana says it found no independent confirmation that v10.3.4.45 fully fixes the flaws[4].SecurityWeek quotes Huntress as recommending that "access should be limited to trusted IP addresses only or require VPN."[5]