Ahsay AhsayCBS: Improper Authentication Vulnerability
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Is it being exploited: yes. CISA added it to its list of actively exploited flaws on 14 October 2026.
Who is affected: anyone running Ahsay AhsayCBS. Check the vendor's advisory for the exact versions.
What to do: Apply mitigations in accordance with vendor instructions. CISA gave US federal agencies until 17 October 2026 to fix it.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.