AhsayCBS Authentication Bypass: CVE-2026-105133 Actively Exploited

What CVE-2026-105133 is and who is affectedAhsay AhsayCBS — the Cloud Backup Suite used by many managed service providers and IT teams to run hosted b...

What CVE-2026-105133 is and who is affected

Ahsay AhsayCBS — the Cloud Backup Suite used by many managed service providers and IT teams to run hosted backup services — carries an improper authentication vulnerability tracked as CVE-2026-105133 (CWE-287). According to the National Vulnerability Database (NVD) of NIST, the flaw affects the checkSysPwd function in the file com/ahsay/obs/api/ApiStructsAction.java, inside the API component. By manipulating the random parameter, a remote attacker can bypass authentication entirely.

The NVD entry states that Ahsay Cloud Backup Suite is affected up to version 10.3.2, and that upgrading to version 10.3.4 mitigates the issue. The published severity is CVSS 4.0 5.5 (MEDIUM). The attack can be launched remotely, no privileges are required and no user interaction is needed, which is why a medium score should not be read as low risk. The NVD also notes that the exploit is now public and may be used.

CISA adds an important detail: this vulnerability can be chained with CVE-2026-105134. Chaining is exactly how a single authentication gap turns into a broader compromise, so the practical exposure is greater than the standalone score suggests.

Why this is urgent: it is already being exploited

This is not a theoretical flaw. CISA added CVE-2026-105133 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026, which means it has been observed in real-world attacks. The KEV listing is the clearest signal available that attackers are actively using the flaw rather than merely reading about it.

CISA gave US federal agencies until 17 October 2026 to apply mitigations in line with vendor instructions, following its BOD 26-04 guidance on prioritising security updates based on risk. Where mitigations are unavailable, the guidance is to discontinue use of the product. The material does not record any known use of this vulnerability in ransomware campaigns, so that link should not be assumed.

For a Spanish SME, the deadline itself matters less than the reasoning behind it: a three-day remediation window reflects how quickly an internet-facing authentication bypass can be turned into an intrusion. If your backup platform is reachable from the internet, treat this as a priority rather than a routine patch.

What to do today

Check whether you run AhsayCBS and in which version. The NVD lists Ahsay Cloud Backup Suite up to 10.3.2 as affected, and describes 10.3.4 as the version that mitigates the issue. Confirm your exact build before assuming you are safe.
Apply the vendor's update or mitigation. Follow the Ahsay release notes for version 10.3.4 and the instructions in the vendor advisory. If a mitigation is not available for your setup, CISA's guidance is to stop using the product.
Look for signs of intrusion. Because the flaw allows authentication to be bypassed through the API, review API access logs, authentication events and administrative activity for anything you cannot explain, and check for unexpected accounts or configuration changes.
Reduce what is exposed to the internet. CISA explicitly asks stakeholders to evaluate each asset's internet exposure. Restrict administrative and API access to trusted networks or a VPN, and do not leave a backup console openly reachable.
Remember the chain. Since CVE-2026-105133 can be combined with CVE-2026-105134, check that both are addressed rather than patching only the authentication flaw.

Backup infrastructure deserves particular attention: it holds copies of everything else, and an attacker who reaches it can delete or encrypt the very data you would rely on to recover. Under GDPR, a compromise of backup systems that store personal data also carries notification obligations, so logging and evidence matter from the first hour.

How a cybersecurity team such as ALMC's can help

For SMEs, online shops and companies in Barcelona, Lleida, Tarragona or Girona running WordPress, PrestaShop or Joomla on their own servers — often with a small IT team and no dedicated security specialist — keeping track of advisories like this one is a constant drain. ALMC's cybersecurity work starts with auditing and penetration testing to find the vulnerabilities that matter, then moves to hardening servers, applying security patches on a schedule, and monitoring for the signs of an intrusion that a busy team would miss.

When something does go wrong, incident response and the repair of a hacked website are part of the same service, so the priority is containment and recovery rather than finger-pointing. The goal is straightforward: close the gaps before someone else finds them, and know exactly what to do when a CVE like this one lands on a Tuesday morning.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.