Vulnerability · Published May 29, 2026 · Assigned by INCIBE

CVE-2026-9508Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStar

Critical 10.0

In plain English

A critical-severity incorrect permission assignment in BioStar 2 (server) from Suprema. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 4.0)10.0Critical

Exploit odds (30 days)0.3%top 72.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly download backup ZIP files via ‘http(s)://[server]/download/…’ without requiring authentication. This exposes highly sensitive information that can lead to server impersonation, unauthorized access to databases, and lateral movement.

Affected products (as reported)

Vendor	Product	Versions
Suprema	BioStar 2 (server)	v2.9.3 – through v2.9.11

Weakness: CWE-732 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-supremas-biostar patch