CVE-2026-16247

The record

In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. Starting with _connect.BRAIN 5.06, the setup no longer executes this tool.

Affected packages

Related vulnerabilities

• CVE-2026-107052 Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead… CWE-276
• CVE-2026-114148 Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate… CWE-276
• CVE-2026-112357 GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before… CWE-276
• CVE-2026-115253 An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory… CWE-276
• CVE-2026-11813 A potential improper permissions vulnerability was reported in the Lenovo Filez Client… CWE-276
• CVE-2026-52766 YesWiki is a wiki system written in PHP. CWE-276
• CVE-2026-77393 In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped… CWE-276
• CVE-2026-75166 Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05… CWE-276