PT-2026-61548 · Bizerba Se & Co. Kg · Connect.Brain

CVE-2026-16247 · Published 2026-07-20 · Updated 2026-07-20

Mitre

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%Bizerba connect.BRAIN or %ProgramData%BizerbaBCT.

Starting with connect.BRAIN 5.06, the setup no longer executes this tool.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2026-16247

Affected Products

Connect.Brain

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-16247 · Security Note
• https://bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0003.pdf · Note
• https://twitter.com/VulmonFeeds/status/2079273788420563320 · Twitter Post