CVE-2026-35097
MediumCVSS 6.9Summary
The KTM e-BOK system enforces a maximum password length of six numeric digits and does not allow alphabetic, special, or extended characters. This issue was fixed in the patch released in June 2026.
Risk Assessment
The organization is at risk of easy password guessing or cracking, potentially leading to unauthorized access to the system and data.
Recommendation
Apply the June 2026 patch immediately and configure a password policy requiring longer and more complex passwords.
Other vulnerabilities in KTM e-BOK
See all- CVE-2026-35096Medium
KTM e-BOK system is vulnerable to Cross‑Site Request Forgery (CSRF) in email-change and password-change functionalities. An authenticated user can be tricked into performing unauthorized changes without their knowledge.
- CVE-2026-35095Medium
The vulnerability in KTM e-BOK allows an attacker to set the session identifier before authentication. If a cookie with a valid name is set, its value remains unchanged after successful login, enabling session hijacking.
Original NVD description (English source)
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.