---
id: "CVE-2026-97361"
page: "https://infrastack.ai/live/CVE-2026-97361"
kind: "vulnerability"
aliases: ["CVE-2026-97361"]
title: "B. Braun SpaceCom and Battery Pack SP with WiFi: privilege escalation via improper privilege management"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "SpaceCom / Battery Pack SP with WiFi", "fixed": [], "affected": "<= U94 (US) / L94 (rest of world), per CVE record mirror, unconfirmed", "ecosystem": "vendor"}]
ecosystems: []
tags: ["b-braun", "battery-pack-sp", "infrastructure", "infusion-pump", "local-access", "medical-device", "space-battery-pack-sp", "spacecom", "wifi"]
not_affected_if: []
published_at: "2026-11-13T18:17:50+00:00"
first_seen_at: "2026-11-13T18:49:31+00:00"
updated_at: "2026-11-13T18:53:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97361", "first_seen_at": "2026-11-13T18:49:31+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-97361-improper-privilege-management-on-b-braun-spacecom", "first_seen_at": "2026-11-13T18:53:41+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-97361-improper-privilege-management-on-b-braun-spacecom"]}]
exploit_sources: []
---

# B. Braun SpaceCom and Battery Pack SP with WiFi: privilege escalation via improper privilege management

Link for people: https://infrastack.ai/live/CVE-2026-97361 (this .md is for agents)

B. Braun lists an improper privilege management flaw (CWE-269) in SpaceCom and the Space Battery Pack SP with WiFi, the communication modules of Space infusion pumps. The CNA vector is local access, low privileges, no user interaction, CVSS 4.0 8.5. No vendor advisory or fixed version is published yet, and no exploitation is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SpaceCom / Battery Pack SP with WiFi affected <= U94 (US) / L94 (rest of world), per CVE record mirror, unconfirmed fixed no fixed version listed

## How to check

Find SpaceCom and Battery Pack SP with WiFi units in your inventory and read their software version. A version at or below U94 (US) or L94 (rest of world) falls in the range the CVE record gives, which is unconfirmed. Check bbraun.com/productsecurity and bbraunusa.com/productsecurity for the vendor bulletin. Keep the devices off the internet and on an isolated, firewalled network segment, as B. Braun advised for earlier Space advisories.

## Timeline

- 2026-11-13T18:49:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97361
- 2026-11-13T18:53:41+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-97361-improper-privilege-management-on-b-braun-spacecom — NVD page is empty. Only a CVE-record mirror (HOL) gives the range <=U/L94. No 2026 B. Braun bulletin found; the latest on its product-security index is 10/2026 for APEX/PINNACLE. Nothing verified. Revisit when B. Braun publishes.

## Documents

- [describes] HOL Guard: CVE-2026-97361 record mirror (CVE List V5) https://hol.org/guard/security/cves/CVE-2026-97361-improper-privilege-management-on-b-braun-spacecom

## From the sources

There exists an improper privilege management vulnerability that could cause privilege escalation at the SpaceCom and Space Battery pack SP with WiFi.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_