CVE-2026-35097

MediumCVSS 6.9/10Last modified Oct 25, 2026

Description

KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters.

This issue was fixed in the patch published in June 2026.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-521

Affected software

VendorProductVersions
KTM Systeme-BOK< 06.2026

References

Timeline

Published
Jun 30, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-350986.9KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authenticaCVE-2026-350997.4Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions areCVE-2026-351024.7HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). The switch-versiCVE-2026-351034.7HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to thCVE-2026-351044.7HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registCVE-2026-351054.7HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, lineCVE-2026-351064.7HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, lineCVE-2026-351074.7HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to theCVE-2026-351093.7HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive infoCVE-2026-35118.6Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticCVE-2026-351105.4HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted oveCVE-2026-351114.8HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application r