The vulnerability CVE-2026-16246 in Bizerba BRAIN2 involves incorrect default permissions caused by the execution of LogPathConfig.exe during setup in versions prior to 3.09. This results in the Windows group Everyone receiving full control over the entire %ProgramData% directory rather than a restricted subdirectory, potentially exposing system data to unauthorized modification. Although the setup process in version 3.09 and later no longer runs this tool, the optional Bizerba ScriptService component continues to execute it until its removal in version 3.11. The issue is classified under CWE-276 (Incorrect Default Permissions) and has a CVSS 3.1 score of 7.3, indicating high severity.

The vulnerability allows unauthorized users in the Windows Everyone group to gain full control over the %ProgramData% directory, which can lead to unauthorized information disclosure, modification, or denial of service affecting the integrity and availability of the system. This broad permission assignment increases the attack surface and risk of exploitation.

No official patch or fix is currently confirmed. The setup process no longer executes the problematic tool starting with BRAIN2 version 3.09, reducing exposure for standard installations. However, the optional Bizerba ScriptService component still executes it and is deprecated, with removal planned in version 3.11. Users should avoid installing or should disable the Bizerba ScriptService component where possible. Monitor vendor advisories for updates or official patches addressing this issue.