CVE-2026-112250
Last modified
CVE-2026-112250 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard. The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard Windows users and can generally only be accessed by users with administrative privileges. Successful exploitation could result in the disclosure of credentials belonging to the configured BRAIN2 service account.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard. The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard Windows users and can generally only be accessed by users with administrative privileges. Successful exploitation could result in the disclosure of credentials belonging to the configured BRAIN2 service account.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Bizerba SE & Co. KG | BRAIN2 | >= 0.0, < 3.10 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-112250?
How severe is CVE-2026-112250?
How do I fix CVE-2026-112250?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-112241Authentication Bypass by Spoofing vulnerability in Brainstor…9.8
- CVE-2026-112242Incorrect Privilege Assignment vulnerability in Cozmoslabs P…8.8
- CVE-2026-112247A weakness has been identified in Wuxi Wubang Security Softw…4.3
- CVE-2026-112248A security vulnerability has been detected in grandnode gran…4.7
- CVE-2026-112249A vulnerability was detected in grandnode grandnode2 up to 2…2.4
- CVE-2026-11225Inappropriate implementation in WebUI in Google Chrome prior…6.5
- CVE-2026-112251A vulnerability was detected in antoinersx clawhost up to 0.…4.3
- CVE-2026-112252A vulnerability has been found in Wuxi Wubang Security Softw…7.3
- CVE-2026-112254A vulnerability was found in agit8or1 clientst0r up to 3.17.…4.3
- CVE-2026-112255Initialization of a resource with an insecure default vulner…2.9
- CVE-2026-112256Acceptance of extraneous untrusted data with trusted data vu…9.2
- CVE-2026-112257A flaw was found in GIMP. The PSD thumbnail resource loader …7.8
Are you affected by CVE-2026-112250?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST