VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 11:13 UTC

CVE-2026-105133

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is pos…

Read full description

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

CVSS 7.3 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

3.0/10

REALITY · THREAT PRIORITY

8.5/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.3: +1.09
Fresh EPSS: 79.47%: +0.40

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 27 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

50/100

Grounded branding (15%)

0/100

HYPE TOTAL30/100

Sources and documents

Press · 22 Oct 2026, 07:00 · Technical Advisory: PHP2Shell Pre-Auth RCE (CVE-2026-109618, CVE-2026-109619) - Bitdefender

Press · 15 Oct 2026, 07:00 · Technical Advisory: AhsayCBS Exploitation Chain (CVE-2026-105133, CVE-2026-105134) - Bitdefender

Help Net Security

Press · 15 Oct 2026, 07:00 · CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products - Help Net Security

The Hacker News

Press · 15 Oct 2026, 07:00 · AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches - The Hacker News

Press · 12 Oct 2026, 07:00 · AhsayCBS Backup Console Under Active Exploitation: CVE-2026-105133/105134 Chain Leads From Auth Bypass to RCE, and 10.3.4.0 Does Not Close It - Rescana

See all 27 source documents

IT Security Guru

Press · 09 Oct 2026, 07:00 · Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners - IT Security Guru

BleepingComputer

Press · 09 Oct 2026, 07:00 · Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto - BleepingComputer

The Hacker News

Press · 09 Oct 2026, 07:00 · Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge - The Hacker News

Press · 09 Oct 2026, 07:00 · Unpatched AhsayCBS Vulnerabilities Exploited in the Wild - SecurityWeek

Press · 08 Oct 2026, 07:00 · Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer - Huntress

Press · 04 Aug 2026, 07:00 · Rapidly Rising Risk: AI in the Shadows - Bitdefender

Press · 26 May 2026, 07:00 · Bitdefender at Infosecurity Europe 2026: Staying Ahead of Faster Threats - Bitdefender

Press · 21 Apr 2026, 07:00 · A Cybersecurity Lifeline for Lean IT Teams: Introducing C.R.E.W. - Bitdefender

Press · 27 Feb 2026, 08:00 · AI in Cybersecurity: Is It Worth the Effort for Lean Security Teams? - Bitdefender

Press · 29 Jan 2026, 08:00 · Bitdefender Named a Customers’ Choice in the 2026 Gartner® Peer Insights™ Voice of the Customer for Endpoint Protection Platforms Report - Bitdefender

Press · 15 Sep 2025, 07:00 · Bitdefender Achieves Unparalleled Testing Results in VBSpam Benchmark - Bitdefender

Press · 06 Feb 2025, 08:00 · Shaping the Future of Cyber Defense at the Global Cybersecurity Camp - Bitdefender

Press · 10 Dec 2024, 02:49 · Half of Businesses Have Yet to Take Control of Password Security; Technology Sector Leads the Pack - Bitdefender

Press · 17 Nov 2024, 02:18 · Security Automation Cuts Breach Costs in Half, New Research Shows - Bitdefender

Press · 19 Jun 2024, 07:00 · Should Narrative Attacks Be a Concern for Businesses? - Bitdefender

Press · 19 Jul 2022, 07:00 · Join Bitdefender at Black Hat 2022 - Bitdefender

Press · 01 Mar 2022, 08:00 · Bitdefender Wins Three AV-TEST Awards - Bitdefender

Press · 14 May 2020, 07:00 · Fake Zoom Phishing Campaign Targets Employees for their Office 365 Credentials - Bitdefender

Press · 17 Mar 2020, 07:00 · Bitdefender blocks CVE-2020-0796 ‘EternalDarkness Bug’ at Network Level - Bitdefender

Press · 18 Oct 2019, 07:00 · Few Companies Restrict Use of Unencrypted or Unsafe USB Drives - Bitdefender

Press · 14 May 2019, 07:00 · FBI Detects New Surveillance Malware Linked to North Korea’s Lazarus Group - Bitdefender

"CVE-2026-105133" - Google News

Press · 12 Dec 2018, 08:00 · How to Avoid Becoming the Next Equifax – Investigation Reveals Breach Was ‘Entirely Preventable’ - Bitdefender

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

━ Hype Score (Perceived) ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.3; EPSS 79.5%
Attention, last 30 days: 5 distinct story titles; 5 press documents; 1 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:51.107056+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

12 Dec 2018, 08:00

Published

04 Oct 2026, 05:15

Added to the CISA KEV catalog

14 Oct 2026, 00:00

Latest press mention

22 Oct 2026, 07:00

Score calculated

05 Nov 2026, 13:59