Notice Regarding Security Vulnerability in ZKBio Time

2026-10-16

Notice Regarding Security Vulnerability in ZKBio Time

This notice is to inform you of a security vulnerability identified in ZKBioTime. It is essential to take the necessary actions to protect your systems for your attention to this matter.

1. Vulnerability Details

A. Vulnerability Number:

i. CVE-2026-108794

ii. CVE-2026-108795

iii. CVE-2026-108796

iv. CVE-2026-108797

v. CVE-2026-108798

B. Scope of Impact:

BioTime V 9.5.0 to BioTime V 9.5.6 Build 20260130.3206

C. Vulnerability Overview:

There are unauthorized access and information disclosure vulnerabilities. If exploited successfully, they may lead to the leakage of stored data and credentials.

2. Vulnerability Solution

A. The vulnerabilities have been fixed in BioTime 9.5.6 Build 3623, released on 8 October 2026. An instant upgrade to the newest version is strongly recommended. The BioTime Upgrade Tool is available to upgrade an earlier 9.5 build in one step.

B. After the upgrade, the encryption key must be replaced. Run "manage.py upgrade_aes_key --apply" and restart the service, then set new passwords under System Settings.

Contact our local technical support if you need assistance with this step. It is strongly advised to take the necessary actions to protect your systems for your attention to this matter.

3. Contact Information

For the remediation package or additional technical support, please contact the ZKTeco branch or authorized partner in your region. We appreciate your prompt attention to this critical matter and remain committed to ensuring the security of your deployment.