Ahsay: 2 Actively-Exploited Flaws Added to CISA KEV
Key findings • Two Ahsay vulnerabilities, CVE-2026-105133 and CVE-2026-105134, added to CISA KEV. • Both flaws are confirmed under active exploitation by threat actors in the wild. • No r…
Key findings
- Two Ahsay vulnerabilities, CVE-2026-105133 and CVE-2026-105134, added to CISA KEV.
- Both flaws are confirmed under active exploitation by threat actors in the wild.
- No ransomware association has been indicated for these specific CVEs.
- Immediate patching and mitigation are critical for all organizations using Ahsay products.
- Federal agencies must remediate these vulnerabilities within CISA's mandated timelines.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert by incorporating two Ahsay vulnerabilities, CVE-2026-105133 and CVE-2026-105134, into its authoritative Known Exploited Vulnerabilities (KEV) Catalog. This addition signifies that both flaws have been confirmed as actively exploited in real-world attacks, elevating them to critical status for all organizations, particularly federal civilian executive branch (FCEB) agencies.
The inclusion of a vulnerability in the KEV catalog serves as a definitive signal that threat actors are successfully leveraging these weaknesses. For federal agencies, this mandates remediation within a strict timeframe to mitigate immediate risks. While specific details regarding the nature of these Ahsay vulnerabilities were not immediately disclosed, their presence in the KEV catalog underscores their severity and the urgent need for defensive action.
The two identified vulnerabilities are:
- **CVE-2026-105133**: A security flaw impacting Ahsay products.
- **CVE-2026-105134**: Another critical vulnerability found within Ahsay's software ecosystem.
At present, there is no indication from the provided information that either CVE-2026-105133 or CVE-2026-105134 are specifically tied to ransomware campaigns. However, active exploitation of any vulnerability can lead to severe consequences, including data breaches, system compromise, and disruption of services, regardless of the ultimate payload.
All organizations utilizing Ahsay products are strongly advised to identify affected systems and apply available patches or mitigation strategies without delay. CISA's Binding Operational Directive (BOD) 22-01 requires federal agencies to address KEV entries within specific deadlines, typically 15 days for actively exploited vulnerabilities. While this directive applies directly to federal entities, it represents a best practice for all public and private sector organizations to prioritize remediation efforts for these confirmed exploited flaws to protect their networks and data from ongoing threats.