Is CVE-2026-9508 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9508 being exploited in the wild.

How severe is CVE-2026-9508?

Informational severity, with a CVSS score of 9.8, published 29 May 2026.

Which products and versions are affected?

Suprema BioStar 2 2.9.3 through 2.9.11.

Is there a fix for CVE-2026-9508?

A patch was published on 2026-05-29: Fixed in latest available versions according to INCIBE advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9508 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9508?

Check whether you run Suprema BioStar 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9508: Suprema BioStar 2 incorrect permission settings in NGINX webroot

CVE-2026-9508 · Severity: info · CVSS 9.8 · Published 2026-05-29

Suprema BioStar 2, a security platform used for access control and biometric management, contains a vulnerability that allows unauthorized individuals to download full system backups. If an administrator has configured backup paths within the web server's directory, an attacker can access these files over the internet without a password. This could lead to the theft of sensitive databases, server impersonation, and a total compromise of the security system.

Technologies: Suprema BioStar 2. Vendors: Suprema.

Quick answers

Is CVE-2026-9508 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9508 being exploited in the wild.
How severe is CVE-2026-9508?: Informational severity, with a CVSS score of 9.8, published 29 May 2026.
Which products and versions are affected?: Suprema BioStar 2 2.9.3 through 2.9.11.
Is there a fix for CVE-2026-9508?: A patch was published on 2026-05-29: Fixed in latest available versions according to INCIBE advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9508 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9508?: Check whether you run Suprema BioStar 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as CWE-732 (Incorrect Permission Assignment for Critical Resource) exists in Suprema BioStar 2 versions 2.9.3 through 2.9.11. When an administrator configures the backup path within the NGINX webroot, the application fails to enforce proper access controls on the resulting directory. An unauthenticated attacker can perform a direct request to the '/download/...' path to retrieve ZIP archives containing sensitive system data. This data can be leveraged for database access, lateral movement, or server impersonation. The vendor has released patches to address this issue, and users are advised to update to the latest version.

Affected products

Suprema BioStar 2 (Server) 2.9.3 through 2.9.11

Timeline

2026-05-29: disclosed: Coordinated disclosure by INCIBE and Jordi Garcia Ribera
2026-05-29: advisory
2026-05-29: patched: Fixed in latest available versions according to INCIBE advisory

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-supremas-biostar

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.