CISA added CVE-2026-105133 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The Ahsay AhsayCBS Improper Authentication Vulnerability affects AhsayCBS and could let a remote attacker bypass authentication by manipulating a parameter used by an API function.
The vulnerability is an improper authentication flaw in the API component’s checkSysPwd function. A remote attacker can manipulate its random parameter to bypass authentication, and the issue can be chained with CVE-2026-105134. The vulnerability has a CVSS score of 7.5, rated HIGH. A patch is available in AhsayCBS version 10.3.4.
CISA’s KEV listing confirms that the vulnerability is being actively exploited. Whether attackers have used it in ransomware campaigns is unknown. CISA set 17 October 2026 as the remediation deadline.
CISA requires organisations to apply mitigations in accordance with Ahsay’s instructions and applicable BOD 26-04 guidance, including the Forensics Triage Requirements. For cloud services, organisations should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly subject to the directive. All organisations should assess their AhsayCBS assets’ internet exposure and review their patching and mitigation status.
For full details, see the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-105133) and [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).