Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L N N 5.3 .0020 9.6 —
AFFECTED Product Versions Fixed BioTime 9.5.6 Build 20260130.3206 – 9.5.6 Build 3623
TIMELINE Oct 11 Reserved by VulDB Oct 12 Published (CNA: VulDB) Oct 16 PATCH SHIPPED — CVE-2026-108795 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623.
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. Upgrading to version 9.5.6 Build 3623 can resolve this issue. It is advisable to upgrade the affected component.
| Date | Event | Detail |
|---|---|---|
| October 11, 2026 | Reserved | Reserved by VulDB |
| October 12, 2026 | Published | Published (CNA: VulDB) |
| October 16, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-108795 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| ZKTeco | BioTime | — | 9.5.6 Build 20260130.3206 | 9.5.6 Build 3623 |
Authoritative record: CVE-2026-108795 at cve.org
Vendors: zkteco
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-108795 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
