KTM System e-BOK patches four session flaws
CERT Polska coordinated fixes for four vulnerabilities in KTM System e-BOK allowing session fixation, CSRF, weak passwords, and brute-force attacks.
Sourcecert.pl — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed four vulnerabilities affecting KTM System e-BOK, a Polish customer self-service portal software, following a report from researcher Jacek Korta. The flaws span session management (CVE-2026-35095), where session identifiers can be fixed by an attacker prior to authentication and remain valid post-login, enabling session hijacking; and CSRF vulnerabilities (CVE-2026-35096) in email and password change functions that allow attackers to forge state-changing requests against authenticated users.
Compounding these issues, the application restricts passwords to six numeric digits only (CVE-2026-35097) and imposes no rate-limiting or lockout on login attempts (CVE-2026-35098). CERT Polska notes that combined, these two weaknesses are particularly severe since a six-digit numeric password space can be exhausted via brute force in a short time given unlimited authentication attempts. All four issues were addressed in a patch released in June 2026 through CERT Polska's coordinated vulnerability disclosure process.
This is a vendor-side disclosure of design and implementation flaws rather than an actively exploited threat; no in-the-wild exploitation is reported. Organizations using KTM System e-BOK should apply the June 2026 patch and review session and authentication configurations.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-35095
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs