Ahsay AhsayCBS Improper Authentication Vulnerability

Ahsay AhsayCBS contains an improper authentication vulnerability tracked as CVE-2026-105133. A remote attacker can bypass authentication by manipulating the random parameter in the API component's checkSysPwd function. This vulnerability can be chained with CVE-2026-105134 to potentially increase the severity of exploitation. The issue is listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. CISA has also published forensics triage requirements as part of the BOD 26-04 implementation guidance. Ahsay has released a patch addressing both CVE-2026-105133 and CVE-2026-105134. Organizations using AhsayCBS are strongly urged to apply the available patch immediately. The vulnerability poses a significant risk due to its remote exploitability and authentication bypass nature.