Vulnerability · Published Jun 30, 2026 · Assigned by CERT-PL
CVE-2026-35097Weak Password Requirements in KTM System e-BOK
Medium 6.9
In plain English
A medium-severity security flaw in e-BOK from KTM System. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.4%top 63.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| KTM System | e-BOK | 0 – before 06.2026 |
Weakness: CWE-521 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
References
- https://cert.pl/posts/2026/06/CVE-2026-35095/ third-party-advisory
- https://ktmsystem.pl/internetowe-biuro-obslugi-klienta/ product