Is there a patch available for CVE-2026-35095?

Yes, a patch is available for CVE-2026-35095. Update the affected software to the latest version immediately.

KTM System e-BOK CVE-2026-35095

Q: What is the CVSS score of CVE-2026-35095?

CVE-2026-35095 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-40322 MEDIUM

Session Fixation (CWE-384)

2026-06-30 CERT-PL

GHSA-7vjj-gwc4-wgq7

Session Fixation Information Disclosure E Bok

4.8

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

e-BOK is a network-accessible web portal (AV:N), exploitation requires no privileges (PR:N) but demands victim login (UI:R), with limited account-level confidentiality and integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 15:01 EUVD

Analysis Generated

Jun 30, 2026 - 14:31 vuln.today

DescriptionCVE.org

KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with a valid name is set, its value remains unchanged after successful login. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

This issue was fixed in the patch published in June 2026.

AnalysisAI

Session fixation in KTM System e-BOK (an online customer service portal) enables an attacker to preset a session identifier in a victim's browser before authentication, which the application then retains unchanged after successful login. Because the server accepts a client-supplied cookie value and never regenerates it at the authentication boundary, an attacker who controls the initial session token can hijack the victim's fully authenticated session. A patch was published by KTM System in June 2026; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

e-BOK (Elektroniczne Biuro Obsługi Klienta) is an online customer service portal developed by Polish vendor KTM System, identified via CPE cpe:2.3:a:ktm_system:e-bok:*:*:*:*:*:*:*:* (all versions). The root cause is CWE-384 (Session Fixation): the application violates the fundamental session management principle that session identifiers must be regenerated at each privilege elevation. Specifically, the portal accepts and preserves a session cookie value supplied by the client prior to login, failing to issue a fresh server-generated token upon successful authentication. Secure implementations must invalidate any pre-authentication session and issue a new, cryptographically random identifier immediately after credentials are validated. The CVSS 4.0 vector (AV:L/UI:P) reflects that successful exploitation depends on the victim performing the authentication action, consistent with the CVSS 4.0 definition that AV:L applies when the attacker relies on user interaction by another party to complete the exploit chain.

RemediationAI

Apply the patch released by KTM System in June 2026 as described in the CERT-PL advisory at https://cert.pl/posts/2026/06/CVE-2026-35095/. The exact patched version number is not confirmed from available data (patch available per vendor advisory - contact KTM System at https://ktmsystem.pl/ for the specific release). If immediate patching is not feasible, a compensating control is to implement server-side enforcement of session ID regeneration on login via a reverse proxy or WAF rule that strips inbound session cookie values that were not issued by the server; however, this is complex to implement reliably without application-layer changes and may break legitimate session resumption flows. A simpler interim measure is to enable short session expiry and require re-authentication frequently, reducing the window during which a hijacked session remains valid. Neither workaround eliminates the root cause.