BRAIN2 CVE-2026-112250

Exploitation requires a specific, non-default installation path: BRAIN2 version up to and including 3.09 must have been installed with Microsoft SQL Server access configured using Integrated Security AND with the Windows account intended to run the BRAIN2 MainService specified during the installation wizard - only then is the service-account password written in cleartext to the setup log. To then read it, an attacker must have access to the temporary directory of the Windows administrator who performed the installation, which the vendor states is accessible only to users with administrative privileges. Limiting factors: local access only, administrative privileges effectively required to reach the file, a conditional/non-default configuration combination, and no network or user-interaction path to the data.

This is a genuinely low-to-moderate real-world risk despite the CWE-532 credential-disclosure impact. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.4) tells a consistent story: exploitation is local only and requires high privileges, because the setup log is written to the temporary directory of the Windows administrator who ran the installer - a location the advisory states is reachable only by administrative users. In practice an attacker must already hold administrative/local access to the install host, which sharply limits standalone severity; the value of the flaw is credential harvesting that may enable lateral movement if the exposed BRAIN2 MainService account has rights beyond that machine. The decision signals do not indicate urgency: the vuln.today priority is 'this_month' (not act_now/emergency). No EPSS score, no CISA KEV listing, and no public exploit were provided - all three exploitation-probability signals are either absent or negative, so there is no evidence of widespread or active exploitation. One caveat worth verifying: C:H is coded because a high-privilege service password can be recovered, but since an attacker already needs admin access to read the file, the marginal confidentiality gain is situational and depends on whether the service account is more privileged than the local admin. No signals conflict here; the picture is a conditional, locally-exploitable information-disclosure issue of limited reach.

An attacker (or malicious insider) who already has administrative access to the Windows host where BRAIN2 was installed under the vulnerable configuration browses the installing administrator's temporary directory and opens the BRAIN2 setup log. The log contains the cleartext password of the Windows account chosen to run the BRAIN2 MainService, which the attacker reuses to authenticate as that service account and potentially pivot to other systems. No public exploit is required - the attack is simply reading a file, though it is gated behind the administrative access needed to reach the admin's temp directory.