What is the CVSS score of CVE-2026-16246?

CVE-2026-16246 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Bizerba BRAIN2 are affected by CVE-2026-16246?

Bizerba BRAIN2 prior to version 3.09 contains a local privilege escalation vulnerability enabling any local user to gain full system access on Windows, creating risk of data breach, system…

How to fix or mitigate CVE-2026-16246?

Within 24 hours, inventory all Bizerba BRAIN2 deployments and identify systems running versions before 3.09. Within 7 days, apply vendor patch upgrading all affected systems to version 3.09 or later, prioritizing business-critical infrastructure. Within 30 days, verify complete patch deployment and document deprecation status of the Bizerba ScriptService component, which reintroduces this misconfiguration in its current form.

Bizerba BRAIN2 CVE-2026-16246

EUVD-2026-45902 HIGH

Incorrect Default Permissions (CWE-276)

2026-07-20 0beee27a-7d8c-424f-8e46-ac453fa147e6

GHSA-r977-vhwm-4c47

Privilege Escalation Microsoft

7.3

CVSS 3.1 · Vendor: 0beee27a-7d8c-424f-8e46-ac453fa147e6

Severity by source

Vendor (0beee27a-7d8c-424f-8e46-ac453fa147e6) PRIMARY

7.3 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

7.3 HIGH

Local-only ACL abuse (AV:L) exploitable by any local account including Everyone (PR:N), low complexity; high integrity impact from tampering with shared trusted files, limited confidentiality/availability.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (0beee27a-7d8c-424f-8e46-ac453fa147e6).

CVSS VectorVendor: 0beee27a-7d8c-424f-8e46-ac453fa147e6

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 12:30 vuln.today

CVE Published

Jul 20, 2026 - 12:17 cve.org

HIGH 7.3

DescriptionCVE.org

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2\.

Starting with BRAIN2 3.09, the setup no longer executes this tool.

However, the optional component Bizerba ScriptService still executes it.

Bizerba ScriptService is being deprecated and will no longer be included starting with BRAIN2 version 3.11.

AnalysisAI

Local privilege escalation in Bizerba BRAIN2 before version 3.09 stems from the setup routine invoking LogPathConfig.exe, which misapplies an overly broad ACL granting the Windows 'Everyone' group full control over the entire %ProgramData% directory rather than the intended %ProgramData%\Bizerba\BRAIN2\ subtree. Any local user can therefore read, modify, or plant files that other applications and services trust, enabling tampering and potential escalation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw is fixed in 3.09, though the optional, soon-to-be-deprecated Bizerba ScriptService component reintroduces the misconfiguration.

Technical ContextAI

BRAIN2 is Bizerba's Windows-based management software for retail weighing, labeling and scale devices. The root cause is CWE-276 (Incorrect Default Permissions): a helper utility, LogPathConfig.exe, is intended to configure logging paths and set permissions on the application's own ProgramData subfolder (%ProgramData%\Bizerba\BRAIN2\), but instead applies a full-control grant for the built-in 'Everyone' security principal at the %ProgramData% root. %ProgramData% (the CSIDL_COMMON_APPDATA location) is a shared, machine-wide directory used by many applications and services to store configuration, state, and executable content that privileged processes read at startup; loosening its ACL breaks a foundational Windows trust boundary. The problem is not a code-execution bug in BRAIN2 itself but an insecure filesystem ACL left behind by the installer/tooling.

RemediationAI

Vendor-released patch: upgrade to BRAIN2 3.09 or later, where the setup no longer executes LogPathConfig.exe. Because the optional Bizerba ScriptService component still runs the vulnerable tool even on 3.09, uninstall or disable Bizerba ScriptService where it is not required, and plan to move to BRAIN2 3.11 or later where ScriptService is removed entirely. As an immediate compensating control on already-affected hosts, manually correct the ACL on %ProgramData%: remove the 'Everyone' full-control entry at the %ProgramData% root and restrict the grant to %ProgramData%\Bizerba\BRAIN2\ only (e.g., via icacls), inheriting the default restrictive permissions on the parent - verify afterward that BRAIN2 logging still functions, as over-tightening the Bizerba subfolder could break log writes. Consult the vendor advisory Bizerba SA-2026-0003 (https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0003.pdf) for authoritative guidance and confirm the exact fixed build.