CVE-2026-35098

KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate-limiting enables efficient brute-force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where passwords are restricted to a six-digit numeric format, this becomes a critical issue, as such passwords can be brute-forced in a relatively short time.

The organization is at risk of user account takeover through brute-force attacks, potentially leading to unauthorized access to sensitive data and systems. The absence of login attempt limits significantly increases the likelihood of a successful attack, especially with weak numeric passwords.

Apply the patch published in June 2026 immediately. Additionally, implement rate-limiting mechanisms and enforce stronger password policies beyond simple numeric formats.