# Zkteco vulnerabilities Source: https://junglewise.ai/threats/vendors/zkteco Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/zkteco.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Zkteco: 0 in the last 7 days and 5 in the last 90 days, 5 of them critical and 1 exploited in the wild. The most recent, CVE-2026-108798, was published on 12 October 2026. 5 vulnerabilities in the last four weeks, up from none in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 5 - All time: 17 (5 critical, 1 exploited in the wild) ## About Zkteco A manufacturer of biometric and security management products including access control and time attendance systems. ## Latest Zkteco vulnerabilities - [CVE-2026-108798: ZKTeco BioTime hard-coded cryptographic key](https://junglewise.ai/threats/cve-2026-108798-a-vulnerability-was-found-in-zkteco-biotime-9-5-6-build-20260130) (high, CVSS 7.3, published 12 Oct 2026) - [CVE-2026-108797: ZKTeco BioTime authorization bypass in Employee REST API](https://junglewise.ai/threats/cve-2026-108797-a-vulnerability-has-been-found-in-zkteco-biotime-9-5-6-build) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-108796: ZKTeco BioTime authorization bypass in biometric data endpoint](https://junglewise.ai/threats/cve-2026-108796-a-flaw-has-been-found-in-zkteco-biotime-9-5-6-build-20260130) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-108795: ZKTeco BioTime improper access control in system settings API](https://junglewise.ai/threats/cve-2026-108795-a-vulnerability-was-detected-in-zkteco-biotime-9-5-6-build) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-108794: ZKTeco BioTime SQL injection in database migration](https://junglewise.ai/threats/cve-2026-108794-a-security-vulnerability-has-been-detected-in-zkteco-biotime-9-5) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-8598: ZKTeco CCTV Cameras auth bypass via undocumented port](https://junglewise.ai/threats/cve-2026-8598-zkteco-cctv-cameras-auth-bypass-via-undocumented-port) (critical, CVSS 9.1, published 20 May 2026) - [CVE-2016-20032: ZKTeco ZKAccess Security System stored XSS in AccHolidays](https://junglewise.ai/threats/cve-2016-20032-zkteco-zkaccess-security-system-stored-xss-in-accholidays) (high, CVSS 7.2, published 16 Mar 2026) - [CVE-2016-20031: ZKTeco ZKBioSecurity auth bypass in visLogin.jsp](https://junglewise.ai/threats/cve-2016-20031-zkteco-zkbiosecurity-auth-bypass-in-vislogin-jsp) (medium, CVSS 5.5, published 16 Mar 2026) - [CVE-2016-20030: ZKTeco ZKBioSecurity user enumeration in authLoginAction](https://junglewise.ai/threats/cve-2016-20030-zkteco-zkbiosecurity-user-enumeration-in-authloginaction) (critical, CVSS 9.8, published 16 Mar 2026) - [CVE-2016-20029: ZKTeco ZKBioSecurity directory traversal in baseAction!getPageXML.action](https://junglewise.ai/threats/cve-2016-20029-zkteco-zkbiosecurity-directory-traversal-in-baseaction-getpagexml) (medium, CVSS 6.2, published 16 Mar 2026) - [CVE-2016-20028: ZKTeco ZKBioSecurity CSRF in superadmin account creation](https://junglewise.ai/threats/cve-2016-20028-zkteco-zkbiosecurity-csrf-in-superadmin-account-creation) (medium, CVSS 4.3, published 16 Mar 2026) - [CVE-2016-20027: ZKTeco ZKBioSecurity reflected XSS in multiple scripts](https://junglewise.ai/threats/cve-2016-20027-zkteco-zkbiosecurity-reflected-xss-in-multiple-scripts) (medium, CVSS 6.1, published 16 Mar 2026) - [CVE-2016-20026: ZKTeco ZKBioSecurity hardcoded credentials in bundled Apache Tomcat](https://junglewise.ai/threats/cve-2016-20026-zkteco-zkbiosecurity-hardcoded-credentials-in-bundled-apache) (critical, CVSS 9.8, published 16 Mar 2026) - [CVE-2016-20025: ZKTeco ZKAccess Professional privilege escalation via insecure file permissions](https://junglewise.ai/threats/cve-2016-20025-zkteco-zkaccess-professional-privilege-escalation-via-insecure) (high, CVSS 8.8, published 16 Mar 2026) - [CVE-2016-20024: ZKTeco ZKTime.Net privilege escalation via insecure file permissions](https://junglewise.ai/threats/cve-2016-20024-zkteco-zktime-net-privilege-escalation-via-insecure-file) (critical, CVSS 9.8, published 16 Mar 2026) - [CVE-2025-15128: ZKTeco BioTime IDOR password disclosure in safe_setting endpoint](https://junglewise.ai/threats/cve-2025-15128-zkteco-biotime-idor-password-disclosure-in-safe-setting-endpoint) (medium, CVSS 5.3, published 28 Dec 2025) - [CVE-2023-38950: ZKTeco BioTime path traversal in iclock API](https://junglewise.ai/threats/cve-2023-38950-zkteco-biotime-path-traversal-in-iclock-api) (critical, exploited in the wild, CVSS 7.5, published 19 May 2025) ## Most severe Zkteco vulnerabilities - [CVE-2023-38950: ZKTeco BioTime path traversal in iclock API](https://junglewise.ai/threats/cve-2023-38950-zkteco-biotime-path-traversal-in-iclock-api) (critical, exploited in the wild, CVSS 7.5, published 19 May 2025) - [CVE-2016-20026: ZKTeco ZKBioSecurity hardcoded credentials in bundled Apache Tomcat](https://junglewise.ai/threats/cve-2016-20026-zkteco-zkbiosecurity-hardcoded-credentials-in-bundled-apache) (critical, CVSS 9.8, published 16 Mar 2026) - [CVE-2016-20030: ZKTeco ZKBioSecurity user enumeration in authLoginAction](https://junglewise.ai/threats/cve-2016-20030-zkteco-zkbiosecurity-user-enumeration-in-authloginaction) (critical, CVSS 9.8, published 16 Mar 2026) - [CVE-2016-20024: ZKTeco ZKTime.Net privilege escalation via insecure file permissions](https://junglewise.ai/threats/cve-2016-20024-zkteco-zktime-net-privilege-escalation-via-insecure-file) (critical, CVSS 9.8, published 16 Mar 2026) - [CVE-2026-8598: ZKTeco CCTV Cameras auth bypass via undocumented port](https://junglewise.ai/threats/cve-2026-8598-zkteco-cctv-cameras-auth-bypass-via-undocumented-port) (critical, CVSS 9.1, published 20 May 2026) - [CVE-2016-20025: ZKTeco ZKAccess Professional privilege escalation via insecure file permissions](https://junglewise.ai/threats/cve-2016-20025-zkteco-zkaccess-professional-privilege-escalation-via-insecure) (high, CVSS 8.8, published 16 Mar 2026) - [CVE-2026-108798: ZKTeco BioTime hard-coded cryptographic key](https://junglewise.ai/threats/cve-2026-108798-a-vulnerability-was-found-in-zkteco-biotime-9-5-6-build-20260130) (high, CVSS 7.3, published 12 Oct 2026) - [CVE-2016-20032: ZKTeco ZKAccess Security System stored XSS in AccHolidays](https://junglewise.ai/threats/cve-2016-20032-zkteco-zkaccess-security-system-stored-xss-in-accholidays) (high, CVSS 7.2, published 16 Mar 2026) - [CVE-2026-108794: ZKTeco BioTime SQL injection in database migration](https://junglewise.ai/threats/cve-2026-108794-a-security-vulnerability-has-been-detected-in-zkteco-biotime-9-5) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2016-20029: ZKTeco ZKBioSecurity directory traversal in baseAction!getPageXML.action](https://junglewise.ai/threats/cve-2016-20029-zkteco-zkbiosecurity-directory-traversal-in-baseaction-getpagexml) (medium, CVSS 6.2, published 16 Mar 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 5 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Zkteco technologies - [Zkteco BioTime](https://junglewise.ai/threats/technologies/biotime): 7 vulnerabilities - [Zkteco ZKBioSecurity](https://junglewise.ai/threats/technologies/zkbiosecurity): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Zkteco vulnerabilities", https://junglewise.ai/threats/vendors/zkteco, 12 November 2026.