<![CDATA[CVE-2026-105133: New CVE Published]]>A newly published vulnerability, tracked as CVE-2026-105133, has been identified in Ahsay AhsayCBS versions up to 10.3.2. The flaw affects the checkSysPwd function within the file com/ahsay/obs/api/ApiStructsAction.java, which is part of the API component. By manipulating the random argument, an attacker can trigger improper authentication.

The vulnerability can be exploited remotely, and a public exploit is now available, meaning it could be used in active attacks. The issue is mitigated by upgrading to version 10.3.4, and upgrading the affected component is strongly recommended.

  • Affected product: Ahsay AhsayCBS up to 10.3.2
  • Affected component: API (checkSysPwd function in com/ahsay/obs/api/ApiStructsAction.java)
  • Exploit status: Publicly available
  • Mitigation: Upgrade to 10.3.4

Source: NVD

Has anyone running AhsayCBS already moved to 10.3.4, or are you seeing signs of exploitation attempts against the API?

]]>https://xploitlk.com/topic/640/cve-2026-105133-new-cve-publishedRSS for NodeTue, 27 Oct 2026 08:53:46 GMTSat, 10 Oct 2026 20:30:24 GMT60