CISA KEV Alert: Ahsay AhsayCBS authentication vulnerability

Summary: CISA has issued an alert regarding an actively exploited improper authentication vulnerability in Ahsay AhsayCBS that allows remote authentication bypass. This flaw is triggered by manipulating the random parameter in the API component’s checkSysPwd function.

This alert from CISA’s Known Exploited Vulnerabilities (KEV) Catalog points to a critical improper authentication vulnerability in the Ahsay AhsayCBS backup solution. Such vulnerabilities can severely compromise system security by allowing unauthorized access.

Technically, the vulnerability arises from manipulating the random parameter within the checkSysPwd function of the API component. This indicates that the authentication mechanism is not functioning correctly, allowing attackers to bypass it using this parameter. The fact that it can be chained with another vulnerability (CVE-2026-105134) further escalates the risk.

For all organizations using Ahsay AhsayCBS, this represents an immediate security risk. Since it is actively exploited, infrastructures utilizing these systems must be promptly inspected, and necessary security measures must be taken. An authentication bypass could lead to unauthorized access to backup data or complete system compromise.

System administrators should check their Ahsay AhsayCBS installations, monitor the CISA KEV catalog, and immediately apply any patches or workarounds released by the vendor. Additional security layers like network segmentation and access control lists (ACLs) can also help mitigate the risk.

🔗 Source: CISA KEV Catalog
📡 Authoritative feeds & live tracking: Radar