# CVE-2026-9509: Suprema BioStar 2 denial of service via unhandled exception

Source: https://junglewise.ai/threats/cve-2026-9509-suprema-biostar-2-denial-of-service-via-unhandled-exception  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-9509 · Severity: info · CVSS 8.7 · Published 2026-05-29

A vulnerability in Suprema BioStar 2, a security platform used for access control and biometric identification, allows an attacker to crash the server remotely. By sending a specific request to the system, an attacker can disable the server and stop all connected door readers from functioning. This results in a total service outage that requires a manual restart to restore building security operations.

Technologies: [Suprema BioStar 2](https://junglewise.ai/threats/technologies/biostar-2). Vendors: [Suprema](https://junglewise.ai/threats/vendors/suprema).

## Quick answers

**Is CVE-2026-9509 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9509 being exploited in the wild.

**How severe is CVE-2026-9509?** Informational severity, with a CVSS score of 8.7, published 29 May 2026.

**Which products and versions are affected?** Suprema BioStar 2 2.9.8, 2.9.10, 2.9.11.

**Is there a fix for CVE-2026-9509?** A patch was published on 2026-05-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9509 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9509?** Check whether you run Suprema BioStar 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as an Uncaught Exception (CWE-248) within the '/api/migration' endpoint of the Suprema BioStar 2 Server. An unauthenticated remote attacker can trigger this exception by sending a specially crafted HTTP POST request. Because the application fails to handle the resulting error, critical server processes halt, leading to a complete Denial of Service (DoS). Exploitation requires no user interaction or privileges and results in the failure of access control readers and third-party integrations until a manual service restart is performed. The vendor has released patches to address this issue.

## Affected products

- Suprema BioStar 2 (Server) 2.9.8, 2.9.10, 2.9.11

## Timeline

- 2026-05-29: disclosed
- 2026-05-29: advisory
- 2026-05-29: patched

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-supremas-biostar](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-supremas-biostar)

## Related threats

- [Suprema BioStar credential exposure in Active Directory endpoint](https://junglewise.ai/threats/cve-2026-31278-suprema-biostar-credential-exposure-in-active-directory-endpoint)
- [Suprema BioStar 2 incorrect permission settings in NGINX webroot](https://junglewise.ai/threats/cve-2026-9508-suprema-biostar-2-incorrect-permission-settings-in-nginx-webroot)