Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N L L L 6.9 .0028 18.9 —
AFFECTED Product Versions Fixed BioTime 9.5.6 Build 20260130.3206 – 9.5.6 Build 3623
TIMELINE Oct 11 Reserved by VulDB Oct 12 Published (CNA: VulDB) Oct 16 PATCH SHIPPED — CVE-2026-108798 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623.
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component.
| Date | Event | Detail |
|---|---|---|
| October 11, 2026 | Reserved | Reserved by VulDB |
| October 12, 2026 | Published | Published (CNA: VulDB) |
| October 16, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-108798 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| ZKTeco | BioTime | — | 9.5.6 Build 20260130.3206 | 9.5.6 Build 3623 |
Authoritative record: CVE-2026-108798 at cve.org
Vendors: zkteco
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-108798 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
