KTM System vulnerabilities

Products

• e-BOK 4

Latest KTM System CVEs

Newest publication first

1. CVE-2026-35098 Improper Restriction of Excessive Authentication Attempts in KTM System e-BOK

   Published 2026-06-30

   Medium·CVSS 6.9 EPSS 0.56%

   KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-...

2. CVE-2026-35097 Weak Password Requirements in KTM System e-BOK

   Published 2026-06-30

   Medium·CVSS 6.9 EPSS 0.42%

   KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.

3. CVE-2026-35096 Cross-Site Request Forgery (CSRF) in KTM System e-BOK

   Published 2026-06-30

   Medium·CVSS 5.1 EPSS 0.22%

   KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and password-change functionalities. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged POST request to the application. T...

4. CVE-2026-35095 Session fixation in KTM System e-BOK

   Published 2026-06-30

   Medium·CVSS 4.8 EPSS 0.21%

   KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with a valid name is set, its value remains unchanged after successful login. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.