Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L N N 5.3 .0022 11.4 —
AFFECTED Product Versions Fixed BioTime 9.5.6 Build 20260130.3206 – 9.5.6 Build 3623
TIMELINE Oct 11 Reserved by VulDB Oct 12 Published (CNA: VulDB) Oct 16 PATCH SHIPPED — CVE-2026-108797 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623.
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version 9.5.6 Build 3623 is able to resolve this issue. The affected component should be upgraded.
| Date | Event | Detail |
|---|---|---|
| October 11, 2026 | Reserved | Reserved by VulDB |
| October 12, 2026 | Published | Published (CNA: VulDB) |
| October 16, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-108797 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| ZKTeco | BioTime | — | 9.5.6 Build 20260130.3206 | 9.5.6 Build 3623 |
Authoritative record: CVE-2026-108797 at cve.org
Vendors: zkteco
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-108797 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
