Live › vulnerability › CVE-2026-112250
Go to dashboardUnder specific installation conditions, BRAIN2 up to and including 3.09 writes the Windows service account password in cleartext to a setup log file. An attacker who can read the installing administrator's temporary directory can recover the BRAIN2 MainService account credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 10:29 UTC. All times on this page are UTC.
Sources describe exposure only for BRAIN2 installs up to and including 3.09 that use SQL Server Integrated Security and a Windows account for the MainService entered in the installer. The log sits in the installing administrator's temp directory, which standard users cannot read. Installs using other database authentication or no Windows service account are not described as affected.
No product ranges from the sources yet.
3.09 or earlier.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard. The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard Windows users and can generally only be accessed by users with administrative privileges. Successful exploitation could result in the disclosure of credentials belonging to the configured BRAIN2 service account.
This page as .md · .json · in your agent: get_signal("CVE-2026-112250")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.