Is CVE-2026-35095 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35095 being exploited in the wild.

How severe is CVE-2026-35095?

Informational severity, with a CVSS score of 4.8, published 30 June 2026.

Which products and versions are affected?

KTM System e-BOK All versions prior to June 2026 update.

Is there a fix for CVE-2026-35095?

A patch was published on 2026-06-01: Patch released in June 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35095 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-35095?

Check whether you run KTM System e-BOK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35095: KTM System e-BOK session fixation

CVE-2026-35095 · Severity: info · CVSS 4.8 · Published 2026-06-30

KTM System e-BOK is a web portal used by housing cooperatives to allow residents to view personal data, billing information, and payment history. A security flaw allows an attacker to fix a user's session ID before they log in, which can lead to the attacker hijacking the user's account once they authenticate. This could result in unauthorized access to a resident's financial records, personal details, and account settings.

Technologies: KTM System e-BOK. Vendors: KTM System.

Quick answers

Is CVE-2026-35095 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35095 being exploited in the wild.
How severe is CVE-2026-35095?: Informational severity, with a CVSS score of 4.8, published 30 June 2026.
Which products and versions are affected?: KTM System e-BOK All versions prior to June 2026 update.
Is there a fix for CVE-2026-35095?: A patch was published on 2026-06-01: Patch released in June 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35095 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-35095?: Check whether you run KTM System e-BOK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A session fixation vulnerability (CWE-384) exists in KTM System e-BOK because the application allows the client to set a session identifier prior to authentication. If a cookie with a valid name is provided by the client, the application fails to regenerate the session ID upon a successful login, maintaining the pre-authentication value. An attacker can exploit this by forcing a specific session ID on a victim's browser (e.g., via physical access or local network manipulation) and then hijacking the session once the victim logs in. The issue was addressed in the June 2026 patch.

Affected products

KTM System e-BOK All versions prior to June 2026 update

Timeline

2026-06-30: advisory: Advisory published by CERT.PL
2026-06-30: disclosed
2026-06-01: patched: Patch released in June 2026

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.