CVE-2026-35098 describes an improper restriction of excessive authentication attempts in the KTM System e-BOK product. The system does not enforce any rate-limiting or timeout on consecutive login attempts, allowing attackers to perform unlimited authentication requests. This vulnerability facilitates brute-force attacks on user accounts. When combined with CVE-2026-35097, which limits passwords to a six-digit numeric format, the risk is significantly increased. The vulnerability was addressed by a patch released in June 2026.

Attackers can perform unlimited authentication attempts against user accounts, enabling efficient brute-force attacks. This can lead to unauthorized access if passwords are guessed successfully. The impact is heightened by the password format restriction to six-digit numeric passwords, which reduces the password space and makes brute-force attacks more practical.

A patch fixing this vulnerability was published in June 2026. Users and administrators should apply the official patch to enforce limits or timeouts on consecutive login attempts. No other mitigation guidance is provided. Patch status is not explicitly confirmed in the advisory, so verify with the vendor for the latest remediation details.