Which versions of Suprema BioStar 2 are affected by CVE-2026-9508?

Suprema BioStar 2 servers (versions 2.9.3-2.9.11) expose sensitive backup archives containing database credentials and cryptographic keys to unauthenticated remote download if backups are stored in…. A patch is available.

How to fix or mitigate CVE-2026-9508?

Within 24 hours: Verify if Suprema BioStar 2 versions 2.9.3-2.9.11 are deployed; check if backup files are stored in NGINX webroot and immediately restrict web access if present. Within 7 days: Contact Suprema for patch availability and apply the vendor-released patch to all affected servers. Within 30 days: Audit access logs for unauthorized backup downloads; rotate database credentials and cryptographic material; review and remediate backup storage configuration to ensure backups are never placed in web-accessible directories.

Suprema BioStar 2 CVE-2026-9508

Q: What is the CVSS score of CVE-2026-9508?

CVE-2026-9508 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33282 CRITICAL

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-05-29 INCIBE

GHSA-3fmq-xr93-jqc5

Authentication Bypass Nginx Biostar 2 Server

10.0

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (INCIBE) · only source for this CVE.

CVSS VectorVendor: INCIBE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:30 vuln.today

CVSS changed

May 29, 2026 - 13:22 NVD

10.0 (CRITICAL)

CVE Published

May 29, 2026 - 12:09 nvd

UNKNOWN (no severity yet)

CVE Published

May 29, 2026 - 12:09 nvd

CRITICAL 10.0

DescriptionCVE.org

Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly download backup ZIP files via ‘http(s)://[server]/download/…’ without requiring authentication. This exposes highly sensitive information that can lead to server impersonation, unauthorized access to databases, and lateral movement.

AnalysisAI

Unauthenticated backup file disclosure in Suprema BioStar 2 server (versions 2.9.3 through 2.9.11) allows remote attackers to download sensitive backup ZIP archives directly via predictable '/download/' URLs when the administrator places the backup path inside the NGINX webroot. The exposed archives can contain database credentials and cryptographic material enabling server impersonation, database compromise, and lateral movement. No public exploit identified at time of analysis, but SSVC rates the flaw as automatable with total technical impact and CVSS 4.0 scores it 10.0.

Technical ContextAI

Suprema BioStar 2 is a widely deployed web-based access control and biometric authentication platform that ships with an embedded NGINX web server to host its management UI and APIs. The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource): when an administrator configures the backup destination directory underneath the NGINX document root, NGINX's default static-file handling serves those files to any HTTP client without invoking the application's authentication layer. Because backups contain a full snapshot of the access-control database (user records, biometric template references, configuration, and likely secrets), the misconfiguration converts a routine operational task into an unauthenticated data exfiltration channel reachable over the standard web port.

RemediationAI

Apply the vendor-released patch referenced in the INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-supremas-biostar (patch availability is confirmed but the exact fixed version is not stated in the supplied data, so consult Suprema directly to confirm the target release before upgrading from any 2.9.3-2.9.11 build). As an immediate compensating control, move the backup destination directory outside the NGINX document root so static-file handling cannot reach it, which fully eliminates the exposure with no functional side effects beyond updating backup tooling paths. If the path cannot be relocated quickly, add an NGINX 'location /download/' block that returns 403 or requires authentication - this blocks the attack but will also break any legitimate workflow that depends on direct download URLs. Rotate any credentials, API keys, or database secrets contained in previously exposed backups, since patching does not undo prior disclosures.