CVE-2026-16247 Overview
CVE-2026-16247 affects Bizerba _connect.BRAIN versions prior to 5.06. During setup, the application LogPathConfig.exe executes and rewrites permissions on %ProgramData%. The tool removes existing access controls and grants the Windows built-in group Everyone full control across the entire %ProgramData% directory. The intended scope was limited to %ProgramData%\Bizerba\_connect.BRAIN and %ProgramData%\Bizerba\BCT. This misconfiguration exposes all subdirectories under %ProgramData% to any authenticated local user. The issue is classified under [CWE-276] Incorrect Default Permissions.
Critical Impact
Any local user can read, modify, or replace files under %ProgramData%, enabling tampering with application data and potential privilege escalation through binary or configuration replacement.
Affected Products
- Bizerba _connect.BRAIN versions prior to 5.06
- Windows installations running the affected setup executing LogPathConfig.exe
- Systems where Bizerba BCT components share the %ProgramData% root
Discovery Timeline
- 2026-07-20 - CVE-2026-16247 published to NVD
- 2026-07-21 - Last updated in NVD database
- 2026 - Bizerba published Security Advisory SA-2026-0003
Technical Details for CVE-2026-16247
Vulnerability Analysis
The vulnerability stems from an overly broad ACL modification performed during installation. When the Bizerba _connect.BRAIN installer runs LogPathConfig.exe, the utility discards the inherited discretionary access control list (DACL) on %ProgramData% and applies a new DACL granting Everyone: Full Control. This change affects the entire %ProgramData% directory tree rather than only the Bizerba-specific subfolders. Any local, authenticated user gains the ability to read, write, delete, or replace files owned by other applications that store data under %ProgramData%. The vulnerability is exploited locally and requires only low privileges with no user interaction.
Root Cause
The root cause is [CWE-276] Incorrect Default Permissions. LogPathConfig.exe targets the wrong directory scope and applies a permissive DACL to a shared system location. Starting with _connect.BRAIN 5.06, the setup no longer executes this tool, eliminating the permission rewrite.
Attack Vector
A local authenticated attacker with standard user rights can abuse the misconfigured permissions in several ways. The attacker can replace executables or DLLs that other privileged services load from %ProgramData%, achieving privilege escalation when a higher-privileged process consumes the planted file. The attacker can also modify configuration files, log outputs, or state data used by other applications. Because Everyone is granted full control, tampering does not require any additional exploitation primitive. See the Bizerba Security Advisory SA-2026-0003 for vendor details.
Detection Methods for CVE-2026-16247
Indicators of Compromise
- Presence of LogPathConfig.exe execution in installer logs on hosts running _connect.BRAIN versions below 5.06
- ACL on %ProgramData% showing Everyone with FullControl inherited to child objects
- Unexpected file writes to %ProgramData% subdirectories by non-administrative user accounts
Detection Strategies
- Enumerate %ProgramData% ACLs using icacls %ProgramData% and flag entries granting Everyone:(F) with object inheritance
- Audit Windows Security Event ID 4670 (permissions changed) around Bizerba installation events
- Inventory installed Bizerba _connect.BRAIN versions and match against fixed release 5.06
Monitoring Recommendations
- Enable object access auditing (SACL) on %ProgramData% to record write operations by non-privileged principals
- Monitor for creation or modification of executables and DLLs under %ProgramData% by standard users
- Alert on process launches from %ProgramData% paths by services running as SYSTEM or elevated accounts
How to Mitigate CVE-2026-16247
Immediate Actions Required
- Upgrade Bizerba _connect.BRAIN to version 5.06 or later, which no longer executes LogPathConfig.exe
- Manually reset the DACL on %ProgramData% to the Windows default, restricting write access to SYSTEM and Administrators
- Review all subdirectories under %ProgramData% for files created or modified by standard users since installation
Patch Information
Bizerba addressed the issue starting with _connect.BRAIN 5.06 by removing the LogPathConfig.exe step from the setup process. Refer to Bizerba Security Advisory SA-2026-0003 for the official remediation guidance.
Workarounds
- On systems that cannot be upgraded immediately, restore %ProgramData% permissions to the Windows defaults and re-apply application-specific ACLs only to %ProgramData%\Bizerba\_connect.BRAIN and %ProgramData%\Bizerba\BCT
- Remove the Everyone ACE from %ProgramData% and replace it with Users: ReadAndExecute inherited from the parent
- Restrict interactive logon on affected hosts to trusted administrators until the upgrade is applied
# Reset %ProgramData% ACL to Windows defaults and remove Everyone Full Control
icacls "%ProgramData%" /remove:g Everyone
icacls "%ProgramData%" /grant "NT AUTHORITY\SYSTEM:(OI)(CI)F"
icacls "%ProgramData%" /grant "BUILTIN\Administrators:(OI)(CI)F"
icacls "%ProgramData%" /grant "BUILTIN\Users:(OI)(CI)(RX)"
icacls "%ProgramData%" /grant "CREATOR OWNER:(OI)(CI)(IO)F"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
