What’s Vulnerable › Vulnerabilities
CVE-2026-9508: Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStar
- Severity: critical (CVSS 10.0 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-29 · updated 2026-07-21
- Weakness: CWE-732
Description
Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly download backup ZIP files via ‘http(s)://[server]/download/…’ without requiring authentication. This exposes highly sensitive information that can lead to server impersonation, unauthorized access to databases, and lateral movement.
Affected products
- Suprema BioStar 2 (server): from v2.9.3 through v2.9.11
References
Get alerted when CVE-2026-9508 or the next vulnerability affects your stack