CVE-2026-105133Vulnerability

1. “CVE-2026-105133”

   CERT-FRGovernment19 Oct 2026
   Bulletin d'actualité CERTFR-2026-ACT-044 (19 octobre 2026)

2. “CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability”

   Security AffairsNews15 Oct 2026
   U.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog

3. “CVE-2026-105133, a medium-severity improper authentication vulnerability, and CVE-2026-105134, a critical command injection vulnerability, in Ahsay AhsayCBS”

   Help Net SecurityNews15 Oct 2026
   CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products

4. “The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.”

   The Hacker NewsNews15 Oct 2026
   AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

5. “CVE-2026-105133 and CVE-2026-105134 | AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities”

   Horizon3.aiVendor15 Oct 2026
   CVE-2026-105133 and CVE-2026-105134 | AhsayCBS Authentication Bypass and Remote Code Execution Vulnerabilities

6. “CVE-2026-105133 – An authentication bypass in the API components”

   Horizon3.aiVendor14 Oct 2026
   AhsayCBS Deep-Dive: Auth Bypass to RCE

7. “De kwetsbaarheid met kenmerk CVE-2026-105133 heeft een CVSS-score van 7,3 en betreft onvoldoende authenticatie in de functie checkSysPwd van de AhsayCBS API.”

   NCSC-NL advisoriesGovernment14 Oct 2026
   NCSC-2026-0427 [1.00] [M/H] Kwetsbaarheden verholpen in Ahsay AhsayCBS

8. “CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability”

   CISA advisoriesGovernment14 Oct 2026
   CISA Adds Four Known Exploited Vulnerabilities to Catalog

9. “…ress plugin), CVE-2026-93836 (WPC Product Bundles for WooCommerce WordPress plugin), CVE-2026-94504 (Ninja Forms WordPress plugin), CVE-2026-105133, CVE-2026-105134 (AhsayCBS), CVE-2026-96940 (Microsoft Exchange Server), CVE-2026-63277 (LibreOffice), CVE-2026-59265 (Apache OpenOf…”

   The Hacker NewsNews12 Oct 2026
   ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

10. “CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java" component.”

    The Hacker NewsNews9 Oct 2026
    Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

11. “Tracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.”

    SecurityWeekNews9 Oct 2026
    Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

12. “On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134.”

    HuntressVendor8 Oct 2026
    Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

• updatereceivers[.]doin 5 reports
• apistructsaction[.]javain 2 reports
• fbijobs[.]govin 1 report
• 177.4.12[.]11in 1 report

Also named with it: CVE-2026-105134, CVE-2026-76519, CVE-2026-0322, CVE-2026-102489, CVE-2026-102490, CVE-2026-96940, CVE-2026-59265, CVE-2026-63277, CVE-2026-21589, CVE-2026-86360, CVE-2026-86361, CVE-2026-86362, CVE-2026-91140, CVE-2026-102255, CVE-2026-106197, CVE-2026-106358