Quick answers
- Is CVE-2026-35098 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-35098 being exploited in the wild.
- How severe is CVE-2026-35098?
- Informational severity, with a CVSS score of 6.9, published 30 June 2026.
- Which products and versions are affected?
- KTM System e-BOK All versions prior to June 2026 update.
- Is there a fix for CVE-2026-35098?
- A patch was published on 2026-06-01: Patch released in June 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-35098 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-35098?
- Check whether you run KTM System e-BOK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The KTM System e-BOK web application suffers from an improper restriction of excessive authentication attempts (CWE-307). The application fails to implement rate-limiting, account lockout, or progressive delays on the login interface. This vulnerability is exacerbated by a related issue (CVE-2026-35097) that restricts user passwords to a six-digit numeric format. A remote, unauthenticated attacker can exploit this lack of throttling to perform a high-speed brute-force attack, successfully guessing the 1,000,000 possible password combinations in a short timeframe. The issue was addressed in a patch released in June 2026.
Affected products
- KTM System e-BOK All versions prior to June 2026 update
Timeline
- 2026-06-30: advisory: Advisory published by CERT.PL
- 2026-06-30: disclosed
- 2026-06-01: patched: Patch released in June 2026