Which versions of B&R APROL are affected by CVE-2026-6900?

B&R Industrial Automation's APROL process control system (all versions before R 4.4-01P5) contains a critical TLS certificate validation vulnerability (CVSS 9.1) enabling network-positioned attackers…

How to fix or mitigate CVE-2026-6900?

Within 24 hours: Inventory all APROL deployments and assess network positioning relative to untrusted networks or remote access points. Within 7 days: Implement network segmentation to restrict APROL component communications to air-gapped or strictly firewalled internal networks; enable packet-level TLS monitoring for anomalous certificate behavior. Within 30 days: Monitor B&R Industrial Automation advisory channels for patch R 4.4-01P5 release; establish upgrade procedures and security testing protocols.

B&R APROL CVE-2026-6900

Q: What is the CVSS score of CVE-2026-6900?

CVE-2026-6900 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41868 CRITICAL

Improper Certificate Validation (CWE-295)

2026-07-06 ABB

GHSA-4q88-82vm-7283

Information Disclosure Aprol B R Industrial Automation Gmbh

9.1

CVSS 4.0 · Vendor: ABB

Severity by source

Vendor (ABB) PRIMARY

9.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

Network vector but MITM prerequisite makes AC:H; no auth or interaction (PR:N/UI:N); high confidentiality and integrity from intercept/tamper, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ABB).

CVSS VectorVendor: ABB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 11:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 11:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Jul 06, 2026 - 11:22 NVD

HIGH CRITICAL

CVSS changed

Jul 06, 2026 - 11:22 NVD

7.4 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Jul 06, 2026 - 10:52 vuln.today

DescriptionCVE.org

Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL.

This issue affects APROL: before R 4.4-01P5.

AnalysisAI

Improper TLS certificate validation in B&R Industrial Automation's APROL process control system (all versions before R 4.4-01P5) lets a network-positioned attacker intercept and tamper with supposedly encrypted communications. Because APROL fails to properly verify certificates (CWE-295), an adversary able to sit between components can decrypt sensitive process data and inject manipulated messages. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 4.0 base score of 9.1 reflects the high confidentiality and integrity impact.

Technical ContextAI

APROL is B&R's (an ABB company) distributed control system (DCS) / process automation platform used to run and supervise industrial processes. The root cause is CWE-295 Improper Certificate Validation: the software establishes TLS/SSL connections but does not correctly verify the peer certificate chain, hostname, or trust anchor, so a forged or attacker-supplied certificate is accepted as valid. This defeats the authentication guarantee of TLS, collapsing the encrypted channel into one an attacker can transparently proxy. The affected component is identified only by CPE cpe:2.3:a:b&r_industrial_automation_gmbh:aprol:*, i.e. the APROL application across all versions prior to the fixed release.

RemediationAI

Vendor-released patch: upgrade APROL to R 4.4-01P5 or later, which corrects the certificate validation, as documented in B&R advisory SA26P011 (https://br-cws-assets.de-fra-1.linodeobjects.com/SA26P011-661853b7.pdf). Until the upgrade can be scheduled - patching in OT environments often requires a maintenance window - reduce exposure by strictly segmenting the APROL network so that no untrusted host can occupy a man-in-the-middle position between APROL components, enforcing this with dedicated VLANs, firewall rules, and disabling unnecessary routing to the control network; the trade-off is added network administration and the risk of disrupting legitimate inter-component traffic if rules are too tight. Restrict physical and logical access to the process control LAN and monitor for ARP spoofing or unexpected TLS certificates as a detection compensating control.