Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L N N 5.3 .0022 11.4 —
AFFECTED Product Versions Fixed BioTime 9.5.6 Build 20260130.3206 – 9.5.6 Build 3623
TIMELINE Oct 11 Reserved by VulDB Oct 12 Published (CNA: VulDB) Oct 16 PATCH SHIPPED — CVE-2026-108796 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623.
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. Upgrading to version 9.5.6 Build 3623 is able to mitigate this issue. You should upgrade the affected component.
| Date | Event | Detail |
|---|---|---|
| October 11, 2026 | Reserved | Reserved by VulDB |
| October 12, 2026 | Published | Published (CNA: VulDB) |
| October 16, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-108796 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| ZKTeco | BioTime | — | 9.5.6 Build 20260130.3206 | 9.5.6 Build 3623 |
Authoritative record: CVE-2026-108796 at cve.org
Vendors: zkteco
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-108796 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
