CVE-2016-20026CWE-798

ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution

Critical · published March 15, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00794 · 55.9th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-03-15T13:35Z
EPSS history
Timeline
  • 15 MAR 13:35Z
    ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution
    cvelistv5