AhsayCBS auth bypass, exploited in wild (CVE-2026-105133) [PoC]

Actively exploited in the wild - CVE-2026-105133 is a high severity authentication bypass in Ahsay AhsayCBS up to 10.3.2 that lets a remote attacker with no credentials defeat the API login check by manipulating the random parameter. Public exploit code is circulating and the flaw is confirmed as exploited in the wild, so treat any internet exposed AhsayCBS console as untrusted until you upgrade to 10.3.4.

Overview

AhsayCBS is the centralized backup server component of the Ahsay backup platform, commonly deployed by managed service providers to hold client backup data, credentials, and scheduling logic. It exposes an API that handles authentication through the class com.ahsay.obs.api.ApiStructsAction, specifically the checkSysPwd function.

CVE-2026-105133 is an improper authentication weakness in that function. When an attacker manipulates the random argument during the authentication exchange, the server can be tricked into accepting a login it should have rejected. No username, password, or prior session is required, and no user interaction is needed on the victim side. The attack travels over the network, and both the technical details and working exploit code are public.

The vendor addressed the issue in AhsayCBS 10.3.4.

Impact

A successful bypass gives an attacker an authenticated foothold in the backup management console. From there the blast radius is severe because backup servers are high value targets: they aggregate credentials, retention policies, and restore points for every protected endpoint. An intruder who reaches the console can generally enumerate backup sets, read or alter job configuration, and in many deployments trigger restores that overwrite production data. Ransomware operators have repeatedly targeted backup infrastructure specifically to eliminate recovery options before encrypting production systems, which makes a pre-authentication bypass on this class of appliance especially dangerous.

Because the CVSS vector is network reachable, low complexity, no privileges, and no user interaction, the only meaningful precondition is that the AhsayCBS console or API is exposed to an untrusted network.

Remediation and Mitigation

• Upgrade AhsayCBS to version 10.3.4 or later. This is the vendor supported fix and the only complete remediation.
• If you cannot upgrade immediately, remove the AhsayCBS management console and API from direct internet exposure. Place it behind a VPN, an allowlisted reverse proxy, or a zero trust access gateway.
• Restrict inbound access to the console ports with firewall rules limited to known administrative source addresses.
• Review authentication and API logs for unexpected or failed checkSysPwd calls, anomalous source IP addresses, and logins outside normal administrative hours.
• Rotate administrative credentials and any API tokens stored in the appliance, and verify that no unauthorized backup jobs, restore tasks, or new administrative accounts were created.
• Where the appliance was internet facing and unpatched, treat the host as potentially compromised and perform a full forensic review before trusting it for recovery.

For incident reporting and related coverage, see breach reports and security news.

Security Insight

The EPSS score for CVE-2026-105133 is only around 0.4 percent, yet CISA has confirmed active exploitation. That gap is the story: EPSS models broad opportunistic scanning, while backup infrastructure is attacked deliberately by small numbers of motivated actors. It also mirrors earlier episodes where authentication checks buried inside API structs were reached and manipulated, a pattern that suggests authentication logic in this product has historically been spread across too many handlers rather than centralized. For defenders, the takeaway is that a low EPSS number is not a reason to deprioritize a pre-authentication bypass in backup software.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs