The vulnerability is an absence of rate limiting on consecutive login attempts in KTM System e‑BOK, allowing unlimited authentication requests. This creates an opportunity for brute‑force attacks; when combined with the six‑digit numeric password scheme from CVE‑2026‑35097, an attacker can discover valid credentials in a relatively short period, compromising user accounts and granting unauthorized access to sensitive data and services.

The affected product is KTM System e‑BOK, an online customer service provided, but the issue was fixed by a patch released in June 2026. Administrators should verify that their deployment is updated to the patched version.

The CVSS score of 6.9 indicates a serious risk, while the EPSS score is not available, so the exploitation probability cannot be quantified; the vulnerability is not catalog. Based on the description, the likely attack vector is remote authentication over the network, where an attacker can repeatedly submit login attempts from any IP, making exploitation straightforward if password entropy is low. The absence of throttling or account lockout means brute‑forcing is efficient and not limited by the system.