The vulnerability CVE-2026-16247 in Bizerba SE & Co. KG's _connect.BRAIN affects versions prior to 5.06. During setup, the LogPathConfig.exe application deletes existing permissions on the %ProgramData% directory and replaces them with permissions granting the Windows group Everyone full control. This is an incorrect default permission setting (CWE-276) that could lead to unauthorized access to data stored under %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. The issue is resolved starting with version 5.06, where the setup no longer executes this tool.

The vulnerability allows unauthorized users with local access to gain full control over the %ProgramData% directory, potentially leading to confidentiality, integrity, and availability impacts on data related to _connect.BRAIN. The CVSS 3.1 score is 7.3 (high), reflecting high impact on confidentiality and integrity, and low attack vector complexity requiring local privileges.

Upgrade to _connect.BRAIN version 5.06 or later, as these versions no longer execute the LogPathConfig.exe tool during setup and thus do not apply the incorrect permissions. Patch status is not explicitly confirmed in vendor advisory content, but the description states the issue is resolved starting with 5.06. Until upgrade, restrict local access to affected systems to mitigate risk.