Is there a patch available for CVE-2026-35097?

Yes, a patch is available for CVE-2026-35097. Update the affected software to the latest version immediately.

KTM System e-BOK CVE-2026-35097

Q: What is the CVSS score of CVE-2026-35097?

CVE-2026-35097 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40324 MEDIUM

Weak Password Requirements (CWE-521)

2026-06-30 CERT-PL

GHSA-fv8h-9jrm-xcpc

Brute Force Information Disclosure E Bok

6.9

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable login endpoint, no privileges needed to brute-force; limited C/I impact on account compromise; no availability impact confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 15:01 EUVD

Analysis Generated

Jun 30, 2026 - 14:32 vuln.today

DescriptionCVE.org

KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters.

This issue was fixed in the patch published in June 2026.

AnalysisAI

KTM System e-BOK enforces a system-wide password policy that restricts all user credentials to exactly six numeric digits, prohibiting alphabetic, special, or extended characters and producing a maximum keyspace of only 1,000,000 possible values (10^6). This CWE-521 (Weak Password Requirements) flaw enables remote unauthenticated brute-force attacks against any customer account, as confirmed by the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). No public exploit code or CISA KEV listing exists, but the trivial keyspace means no specialized tooling is required - standard credential automation suffices. CERT-PL reported the issue; a vendor patch was published in June 2026.

Technical ContextAI

e-BOK ('elektroniczne Biuro Obsługi Klienta' - Electronic Customer Service Office) is a Polish-market web-based self-service portal developed by KTM System, used by utility or municipal service providers for customer account management, billing, and service requests. The root cause is CWE-521 (Weak Password Requirements): the application enforces a server-side constraint that caps password length at six characters and restricts the character set exclusively to decimal digits [0-9]. This yields a deterministic keyspace ceiling of exactly 1,000,000 combinations - trivially exhaustible by automated tooling, and further reduced in practice by predictable user patterns (birth years, sequential digits, repeated values). The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms the attack surface is network-reachable with no complexity or pre-existing privilege. The affected CPE string cpe:2.3:a:ktm_system:e-bok:*:*:*:*:*:*:*:* uses a wildcard version, indicating all tracked versions prior to the June 2026 patch are in scope.

RemediationAI

Apply the KTM System e-BOK patch published in June 2026, available through the vendor at https://ktmsystem.pl/internetowe-biuro-obslugi-klienta/. An exact patched version number is not confirmed in available data - contact KTM System directly to obtain the specific release. As an interim compensating control before patching, configure account lockout after a low threshold of failed attempts (e.g., 5-10) to throttle online brute-force; note this introduces an account-denial risk for legitimate users and should be paired with an account-recovery mechanism. After applying the patch, require a forced password reset for all active accounts, since any existing 6-digit numeric passwords remain weak credentials even once the policy is corrected. Consult the CERT-PL advisory at https://cert.pl/posts/2026/06/CVE-2026-35095/ for any additional remediation guidance issued by the reporting party.