Bizerba BRAIN2 CVE-2026-16246

Exploitation requires local access to a Windows host running BRAIN2 installed at a version prior to 3.09, OR a 3.09+ installation that includes the optional Bizerba ScriptService component (which still executes LogPathConfig.exe). The concrete precondition is that LogPathConfig.exe has run during setup/service operation, leaving the 'Everyone' group with full control of %ProgramData%. Limiting factors: the attack vector is local (AV:L) so no remote/network exploitation is possible; the attacker must already be able to execute code or write files as any local account; and installations that were installed fresh on 3.09+ without ScriptService are not affected. There is no user-interaction or authentication barrier once local access exists, since the 'Everyone' principal encompasses all local users.

The CVSS 3.1 base score of 7.3 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) describes a locally-exploitable, low-complexity issue with high integrity impact and lower confidentiality/availability impact - consistent with a filesystem-permission weakness that primarily lets a local actor tamper with shared data rather than directly read secrets or crash the host. Attack vector is explicitly Local (AV:L), so this is not a remotely reachable flaw and its blast radius is limited to systems where an attacker already has some foothold or interactive/local user access. No EPSS score, SSVC decision, KEV entry, or POC was provided in the intelligence, so exploitation likelihood cannot be quantified from data; the absence of KEV/POC signals combined with a local-only vector suggests this is a real but lower-urgency hardening priority rather than an actively-exploited emergency. One nuance to verify: the vector lists PR:N (no privileges required), which is defensible because the 'Everyone' group includes essentially any local account, but exploitation still presupposes local presence on the machine - network-only attackers cannot reach it.

A low-privileged local user (or malware running in a standard user context) enumerates %ProgramData%, discovers the world-writable ACL, and plants or replaces a configuration file or executable that a higher-privileged BRAIN2 or third-party service later loads from that shared location. When the privileged process consumes the attacker-controlled file, the attacker gains elevated integrity impact and a path toward privilege escalation. No public POC was identified, but the misconfiguration is trivial to identify and abuse given the low attack complexity.