VulnSocial

CVE-2026-9508Disclosure

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly download backup ZIP files via ‘http(s)://[server]/download/…’ without requiring authentication. This exposes highly sensitive information that can lead to server impersonation, unauthorized access to databases, and lateral movement.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-732

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 4 classified signals
  • Peaked 2d ago at 2 mentions (2026-05-29); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-05-29: 2Mentions · 2026-06-16: 1Mentions · 2026-06-17: 1Technical Details · 2026-05-29: 105-2906-1606-17
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-05-292
Disclosure2
2026-06-161
Disclosure1
2026-06-171
Disclosure1
Full discourse4 posts
  • INCIBE-CERT@incibe_cert
    Disclosure

    ⚠️#INCIBEaviso | Múltiples vulnerabilidades en BioStar de #Suprema #CVE CVE-2026-9508 y CVE-2026-9509 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-biostar-de-suprema #AvisosDeSeguridad #TI #CNA

    Post summary

    Incibe has issued an alert for multiple vulnerabilities (CVE-2026-9508 & 9509) in Suprema BioStar, but the brief does not include PoC, exploit, or patch details.

    01010489
    42.8K followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    Disclosure

    【緊急】CVE-2026-9508 Suprema BioStar 2 (versions 2.9.3 through 2.9.11)に深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/06/13/cve-2026-9508-suprema-biostar-2-versions-293-through-2911/ #IT #Security #cybersecurity

    Post summary

    An urgent alert highlights a severe vulnerability (CVE‑2026‑9508) affecting Suprema BioStar 2 versions 2.9.3–2.9.11, but it lacks technical specifics, proof of concept, patch info, or evidence of active exploitation.

    0000043
    209 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    Disclosure

    【緊急】CVE-2026-9508 Suprema BioStar 2 (versions 2.9.3 through 2.9.11)に深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/06/13/cve-2026-9508-suprema-biostar-2-versions-293-through-2911/ #IT #Security #cybersecurity

    Post summary

    An urgent advisory announces a critical vulnerability (CVE-2026-9508) in Suprema BioStar 2 versions 2.9.3–2.9.11, calling for immediate remediation.

    0000031
    209 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-9508 Information Disclosure in Suprema BioStar 2 via Publicly Exposed B... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9508 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The text announces the discovery of CVE‑2026‑9508, an information‑disclosure flaw in Suprema BioStar 2, without providing detailed technical information, a PoC, or mitigation guidance.

    0000059
    4.0K followersView on X

Explore more

Back to dashboard