CVE-2016-20026

CVE-2016-20026 describes a critical vulnerability in ZKTeco ZKBioSecurity 3.0, where hardcoded credentials in its bundled Apache Tomcat server allow unauthenticated access to the manager application. Rated 9.8 Critical, this flaw enables attackers to use these credentials to upload malicious WAR archives and achieve arbitrary code execution with SYSTEM privileges over the network with low complexity and no user interaction. Despite its severe impact, there is currently no evidence of active exploitation, nor are public exploit modules available in Metasploit, Nuclei, or ExploitDB. Furthermore, community discussion and media coverage regarding this CVE are absent, suggesting a lack of widespread attention or observed exploitation.