Is CVE-2026-9508 actively exploited?

No active exploitation of CVE-2026-9508 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9508 be exploited remotely?

Yes. CVE-2026-9508 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-9508?

CVE-2026-9508 has a CVSS score of 10.0 (CRITICAL).

HOME VULNERABILITIESCVE-2026-9508

CRITICAL

CVE-2026-9508

CWE-732Published: May 29, 2026· Updated: May 29, 2026

10.0

CVSS v3.1

EPSS:0.07%probability of exploitation in 30 daysPercentile:20.6th

Official Description

Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly download backup ZIP files via ‘http(s)://[server]/download/…’ without requiring authentication. This exposes highly sensitive information that can lead to server impersonation, unauthorized access to databases, and lateral movement.

NVD Source

Risk Analysis

This critical vulnerability in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) allows unauthenticated attackers to download sensitive backup files. The flaw is due to incorrect permission settings that expose backup files when their path is configured within the NGINX webroot. With a CVSS score of 10.0, this can lead to server impersonation, unauthorized database access, and lateral movement.

No public exploit is currently known for this vulnerability. However, its remote exploitability and low attack complexity make it a severe threat, as it can be exploited by unauthenticated attackers.

Recommended Action

Administrators of Suprema BioStar 2 should ensure that backup files are stored outside the NGINX webroot or any publicly accessible directory. Review and correct permission settings for critical resources to prevent unauthorized access.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-9508 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X