CVE-2026-35097: Weak Password Requirements in KTM System e-BOK

Severity: medium (CVSS 6.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-30 · updated 2026-10-25
Weakness: CWE-521

Description

KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.

Affected products

KTM System e-BOK: before 06.2026 — fixed in 06.2026

How to fix

Upgrade to a fixed version: KTM System e-BOK 06.2026. Check the vendor advisory for mitigations.

References

https://cert.pl/posts/2026/06/CVE-2026-35095/
https://ktmsystem.pl/internetowe-biuro-obslugi-klienta/

Get alerted when CVE-2026-35097 or the next vulnerability affects your stack