Weak Password Requirements in KTM System e-BOK
Priority LOW 37CWE-521Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-521.
Summary
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00421 36th percentileScored 2026-11-07
Fix Fixed e-BOK (KTM System): 06.2026
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| KTM System | e-BOK | before 06.2026 | 06.2026 | Patch available | CNA |
- e-BOK VendorKTM System Affected before 06.2026 Fixed in 06.2026 Patch available CNA
Remediation
- Fix · CNA e-BOK (KTM System) Fixed in 06.2026
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
KTM System e-BOK 06.2026
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2026-27298 Improper Restriction of Excessive Authentication Attempts in KTM System e-BOKPriority LOW 37
- TI-2026-27296 Cross-Site Request Forgery (CSRF) in KTM System e-BOKPriority LOW 23
- TI-2026-27295 Session fixation in KTM System e-BOKPriority LOW 21
Timeline
- 2026-10-02 Threatist record created from CVE-2026-35097
- 2026-10-03 Alias added: GHSA-fv8h-9jrm-xcpc
References
More KTM System vulnerabilities
- TI-2026-27298 Improper Restriction of Excessive Authentication Attempts in KTM System e-BOK CVSS 4.0MEDIUM 6.9
- TI-2026-27296 Cross-Site Request Forgery (CSRF) in KTM System e-BOK CVSS 4.0MEDIUM 5.1
- TI-2026-27295 Session fixation in KTM System e-BOK CVSS 4.0MEDIUM 4.8
Sources
- CVE-2026-35097 · CVE Program
- CVE-2026-35097 · NVD
- FIRST EPSS
- GHSA-fv8h-9jrm-xcpc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences