ZKTeco has 6 CVEs on record between 2023 and 2026. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 5.3 (medium). 17% have been exploited in the wild — well above the 1% corpus average, so ZKTeco flaws are worth patching on sight.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 17% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —(1)
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2023-38950High· 7.5A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload85CVE-2026-108798High· 7.3A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.320640CVE-2026-108797Medium· 4.3A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.320636CVE-2026-108796Medium· 4.3A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.320636CVE-2026-108795Medium· 4.3A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.320636
ZKTeco vulnerabilities
CVEs affecting ZKTeco, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-108798High· 7.3A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to versi…
CVE-2026-108797Medium· 4.3PoCA vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass.…
CVE-2026-108796Medium· 4.3PoCA flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to auth…
CVE-2026-108795Medium· 4.3PoCA vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results i…
CVE-2026-108794Medium· 6.3A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206
A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Mi…
CVE-2023-38950High· 7.5CISA KEVPoCA path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.