CVE-2026-35098

KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where passwords are restricted to a six‑digit numeric format, this becomes a critical issue, as such passwords can be brute‑forced in a relatively short time. This issue was fixed in the patch published in June 2026.

• CWE-307

• https://cert.pl/posts/2026/06/CVE-2026-35095/
• https://ktmsystem.pl/internetowe-biuro-obslugi-klienta/

Published

Jun 30, 2026

Last Modified

Oct 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35092A flaw was found in Corosync. An integer overflow vulnerabil…7.5
• CVE-2026-35093A flaw was found in libinput. A local attacker who can place…8.8
• CVE-2026-35094A flaw was found in libinput. An attacker capable of deployi…5.5
• CVE-2026-35095KTM System e-BOK allows the session identifier to be set by …4.8
• CVE-2026-35096KTM System e-BOK is vulnerable to Cross‑Site Request Forgery…5.1
• CVE-2026-35097KTM System e-BOK enforces a maximum password length of six n…6.9
• CVE-2026-35099Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condi…7.4
• CVE-2026-35102HCL AION is affected by an open redirect vulnerability in th…4.7
• CVE-2026-35103HCL AION is affected by an open redirect vulnerability on th…4.7
• CVE-2026-35104HCL AION is affected by an open redirect vulnerability on th…4.7
• CVE-2026-35105HCL AION is affected by an open redirect vulnerability in th…4.7
• CVE-2026-35106HCL AION is affected by an open redirect vulnerability in th…4.7