Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-112250medium4.4

Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files

Impact

A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard. The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard…

Source excerpt · bizerba

What to do

This vulnerability has been fixed in BRAIN2 version 3.10.

Customers are strongly advised to upgrade to BRAIN2 version 3.10 or later.

bizerba guidance

Until an upgrade can be applied, Bizerba recommends implementing the following measures:

·         Delete BRAIN2 installation log files after successful installation.

·         Restrict administrative access to affected systems.

·         Ensure temporary directories containing installation artifacts are adequately protected.

·         Change the password of the configured service account if credential exposure is suspected.

Administrators should review and remove setup log files following the naming convention:

Bizerba BRAIN2_<Version><InstallationDate><InstallationTime>_setup.log

bizerba guidance

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Bizerba SE & Co. KG · bizerba

BRAIN2

1 range
bizerba version evidence
Platforms: Windows, x86, 64 bit

Compare with this publisher’s ranges. This does not inspect your installation.

affected

0.0 → before 3.10

semver versions

unaffected

unknown

Other versions: unaffected

Original source description

A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard. The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard Windows users and can generally only be accessed by users with administrative privileges. Successful exploitation could result in the disclosure of credentials belonging to the configured BRAIN2 service account.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-112250

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-532 ↗

CWE-532 Insertion of sensitive information into log file

bizerba

Related →
Contributing organizations · 2
bizerba

Assigning organization

2026-10-26
CISA-ADP

Additional data publisher

2026-10-26

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

1 sources
www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0004.pdf
Security advisorybizerba