CVE-2026-31278: Supremainc Biostar 2

High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

Affected products

• Supremainc Biostar 2: before 2.9.12 (fixed in 2.9.12)

Published 2026-09-14. Last modified 2026-09-22.