CVE Explorer
CVE-2026-35097
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters.
This issue was fixed in the patch published in June 2026.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","modules":["e-BOK"],"product":"e-BOK","vendor":"KTM System","versions":[{"lessThan":"06.2026","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:e1d0456be4dc77bf4f51d7ef0363f45443c673659601398511b20edaedb06e98 · sha256:94cb74d267ac2b23… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:e1d0456be4dc77bf4f51d7ef0363f45443c673659601398511b20edaedb06e98 · sha256:94cb74d267ac2b23… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-521","description":"CWE-521: Weak Password Requirements","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:e1d0456be4dc77bf4f51d7ef0363f45443c673659601398511b20edaedb06e98 · sha256:94cb74d267ac2b23… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"tags":["third-party-advisory"],"url":"https://cert.pl/posts/2026/06/CVE-2026-35095/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:e1d0456be4dc77bf4f51d7ef0363f45443c673659601398511b20edaedb06e98 · sha256:94cb74d267ac2b23… · /containers/cna/references/0
{"tags":["product"],"url":"https://ktmsystem.pl/internetowe-biuro-obslugi-klienta/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:e1d0456be4dc77bf4f51d7ef0363f45443c673659601398511b20edaedb06e98 · sha256:94cb74d267ac2b23… · /containers/cna/references/1
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.