Is CVE-2026-35096 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35096 being exploited in the wild.

How severe is CVE-2026-35096?

Informational severity, with a CVSS score of 5.1, published 30 June 2026.

Which products and versions are affected?

KTM System e-BOK All versions prior to June 2026 update.

Is there a fix for CVE-2026-35096?

A patch was published on 2026-06. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35096 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-35096?

Check whether you run KTM System e-BOK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35096: KTM System e-BOK CSRF in email and password change functions

CVE-2026-35096 · Severity: info · CVSS 5.1 · Published 2026-06-30

KTM System e-BOK is a web portal used by housing cooperatives to allow residents to view personal data, billing information, and manage their accounts. A security flaw allows an attacker to trick a logged-in user into visiting a malicious website that silently triggers a change to the user's email address or password. This could lead to unauthorized account takeover and access to the resident's private financial and housing records.

Technologies: KTM System e-BOK. Vendors: KTM System.

Quick answers

Is CVE-2026-35096 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35096 being exploited in the wild.
How severe is CVE-2026-35096?: Informational severity, with a CVSS score of 5.1, published 30 June 2026.
Which products and versions are affected?: KTM System e-BOK All versions prior to June 2026 update.
Is there a fix for CVE-2026-35096?: A patch was published on 2026-06. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35096 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-35096?: Check whether you run KTM System e-BOK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the KTM System e-BOK portal within the email and password update modules. The application fails to properly validate that requests are intentionally initiated by the authenticated user, such as through the use of anti-CSRF tokens. An attacker can exploit this by hosting a malicious page that submits a hidden POST request to the vulnerable endpoints when visited by a victim with an active session. Successful exploitation allows the attacker to change the victim's credentials or recovery email, leading to full account compromise. The issue was addressed in the June 2026 patch.

Affected products

KTM System e-BOK All versions prior to June 2026 update

Timeline

2026-06-30: advisory: Advisory published by CERT.PL
2026-06-30: disclosed
2026-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.