CVE-2026-16246: BRAIN2 Privilege Escalation Vulnerability

CVE-2026-16246 Overview

CVE-2026-16246 is an insecure default permissions vulnerability [CWE-276] affecting Bizerba BRAIN2 versions prior to 3.09. During setup, the LogPathConfig.exe tool grants the Windows Everyone group full control over %ProgramData% instead of scoping the permissions to %ProgramData%\Bizerba\BRAIN2\. Any local user can then modify files belonging to other applications that store data under %ProgramData%.

The issue enables local privilege escalation and integrity compromise across unrelated software on the host. Starting with BRAIN2 3.09, the setup no longer runs this tool, but the optional Bizerba ScriptService component still executes it. Bizerba ScriptService is deprecated and will be removed in BRAIN2 3.11.

Critical Impact
A local, unauthenticated user can tamper with files under %ProgramData% belonging to any application, enabling privilege escalation and persistence.

Affected Products

Bizerba BRAIN2 versions prior to 3.09
Bizerba BRAIN2 3.09 and 3.10 when the optional Bizerba ScriptService component is installed
Windows hosts where BRAIN2 setup or ScriptService executed LogPathConfig.exe

Discovery Timeline

2026-07-20 - CVE-2026-16246 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16246

Vulnerability Analysis

The BRAIN2 installer invokes LogPathConfig.exe to configure logging directories. The tool sets an Access Control List (ACL) intended to grant the Everyone group write access to %ProgramData%\Bizerba\BRAIN2\. The ACL is applied one level too high, targeting %ProgramData% itself.

The resulting permission grants any authenticated local user full control over the shared %ProgramData% directory. Applications commonly store configuration, executables, scheduled task payloads, and update binaries under this location. A low-privileged user can replace or modify those files, and the changes execute in the security context of the application that reads them.

Root Cause

The root cause is improper scoping of ACL inheritance in LogPathConfig.exe. The tool applies a permissive Discretionary Access Control List (DACL) to %ProgramData% rather than to the intended Bizerba subdirectory. This matches the [CWE-276: Incorrect Default Permissions] weakness pattern.

Attack Vector

Exploitation requires local access with no privileges and no user interaction. A local user enumerates writable paths under %ProgramData%, identifies a target application binary or configuration file, and overwrites it. When a privileged process or scheduled task subsequently reads the tampered file, the attacker gains code execution in that context. The vulnerability does not permit remote exploitation.

No verified public exploit code is available for CVE-2026-16246. Refer to the Bizerba Security Advisory SA-2026-0003 for vendor technical details.

Detection Methods for CVE-2026-16246

Indicators of Compromise

Non-default ACL on %ProgramData% granting EveryoneFullControl, visible via icacls C:\ProgramData
Presence of LogPathConfig.exe execution events in application or setup logs
Unexpected file modifications under %ProgramData% subdirectories owned by non-Bizerba applications
Installation of BRAIN2 versions prior to 3.09, or BRAIN2 3.09/3.10 with Bizerba ScriptService present

Detection Strategies

Audit %ProgramData% ACLs across the fleet and flag hosts where the Everyone or Users group holds write or full-control rights on the root directory.
Enable Windows object access auditing (Event ID 4663) on %ProgramData% to capture write operations by non-administrative principals.
Hunt process creation events (Event ID 4688 / Sysmon Event ID 1) referencing LogPathConfig.exe as the child process.

Monitoring Recommendations

Baseline file integrity monitoring on high-value binaries and configuration files stored under %ProgramData%.
Alert on writes to %ProgramData% subdirectories performed by standard user Security Identifiers (SIDs).
Track installation and service state of the Bizerba ScriptService component on all BRAIN2 hosts.

How to Mitigate CVE-2026-16246

Immediate Actions Required

Upgrade BRAIN2 to version 3.11 or later, which removes Bizerba ScriptService and eliminates the vulnerable code path.
On hosts already running BRAIN2 3.09 or 3.10, uninstall the optional Bizerba ScriptService component if it is not required.
Manually reset ACLs on %ProgramData% to the Windows defaults after remediation.

Patch Information

Bizerba addressed the setup-triggered exposure in BRAIN2 3.09 by removing the automatic execution of LogPathConfig.exe. The optional Bizerba ScriptService continues to execute the tool in 3.09 and 3.10. Full remediation requires BRAIN2 3.11, which removes ScriptService entirely. See the Bizerba Security Advisory SA-2026-0003 for release details.

Workarounds

Restore correct permissions with icacls C:\ProgramData /reset /T /C followed by re-applying vendor-specific ACLs only to %ProgramData%\Bizerba\BRAIN2\.
Disable and remove the Bizerba ScriptService Windows service on hosts that do not depend on it.
Restrict interactive and Remote Desktop Protocol (RDP) logon on BRAIN2 hosts to administrators until permissions are corrected.

bash

# Reset %ProgramData% ACL and re-scope BRAIN2 permissions
icacls C:\ProgramData /reset /T /C
icacls "C:\ProgramData\Bizerba\BRAIN2" /grant "Users:(OI)(CI)M"
sc.exe stop "Bizerba ScriptService"
sc.exe delete "Bizerba ScriptService"