What’s Vulnerable › Vulnerabilities

CVE-2016-20026: ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-16 · updated 2026-06-17
• Weakness: CWE-798

Description

ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges.

Affected products

• ZKTeco Inc. ZKTeco ZKBioSecurity: 3.0.1.0_R_230

References

• https://cxsecurity.com/issue/WLB-2016080266
• https://exchange.xforce.ibmcloud.com/vulnerabilities/116484
• https://packetstormsecurity.com/files/138567
• https://www.exploit-db.com/exploits/40324/
• https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-hardcoded-credentials-remote-code-execution
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5362.php

Get alerted when CVE-2016-20026 or the next vulnerability affects your stack