Full Control Vulnerability in BRAIN2 by Bizerba
CVE-2026-16246

7.3HIGH

Key Information:

Vendor

Bizerba Se & Co. Kg

Status
Brain2
Vendor
CVE Published:
20 July 2026

What is CVE-2026-16246?

In earlier versions of the BRAIN2 application (versions prior to 3.09), a setup executable named LogPathConfig.exe unintentionally granted the Windows group 'Everyone' full control over the %ProgramData% directory, instead of limiting access to %ProgramData%\Bizerba\BRAIN2. This security oversight exposes the system to potential unauthorized access. While BRAIN2 version 3.09 mitigates this issue by discontinuing the execution of LogPathConfig.exe during setup, the optional Bizerba ScriptService component continues to utilize this executable, posing further risks. It's important to note that Bizerba ScriptService will be deprecated and removed in BRAIN2 version 3.11.

Affected Version(s)

BRAIN2 Windows >3.09

References

https://www.bizerba.com/downloads/global/information-secu...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.