Which versions of B&R APROL are affected by CVE-2026-6901?

B&R APROL process control systems (all versions prior to R 4.4-01P5) are vulnerable to local privilege escalation allowing low-privileged users to inject malicious code into engineering and operator…

How to fix or mitigate CVE-2026-6901?

24 hours: Audit all APROL installations to identify versions prior to R 4.4-01P5; map local user access patterns and document which stations are critical to operations; restrict unnecessary local user accounts. 7 days: Restrict file system write permissions in APROL application directories and library search paths; implement file integrity monitoring on APROL binaries and libraries; enforce access controls on engineering/operator stations. 30 days: Establish upgrade timeline to APROL R 4.4-01P5 or later when available; coordinate with B&R for patch release estimates; deploy upgrades while maintaining interim controls.

B&R APROL CVE-2026-6901

Q: What is the CVSS score of CVE-2026-6901?

CVE-2026-6901 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41870 HIGH

Untrusted Search Path (CWE-426)

2026-07-06 ABB

GHSA-65g5-qf5m-jpxh

Information Disclosure Aprol B R Industrial Automation Gmbh

8.4

CVSS 4.0 · Vendor: ABB

Severity by source

Vendor (ABB) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Untrusted search path needs local access and an existing low-privileged account (AV:L/PR:L), triggers automatically without interaction (AC:L/UI:N), and yields high confidentiality and integrity but no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ABB).

CVSS VectorVendor: ABB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 11:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 11:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 11:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 11:22 NVD

7.7 (HIGH) 8.4 (HIGH)

Analysis Generated

Jul 06, 2026 - 10:51 vuln.today

DescriptionCVE.org

Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL.

This issue affects APROL: before R 4.4-01P5.

AnalysisAI

Local privilege/code manipulation in B&R Industrial Automation's APROL process control system (all versions before R 4.4-01P5) arises from an untrusted search path (CWE-426), allowing a low-privileged local user to plant a malicious executable or library that the application loads from an attacker-influenced directory. Successful exploitation yields high confidentiality and integrity impact on the affected engineering/operator station. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.4 (High).

Technical ContextAI

APROL is B&R's (an ABB company) distributed process control / SCADA system used to run and engineer industrial automation plants on Linux-based operator and engineering stations. The root cause is classified as CWE-426 (Untrusted Search Path): the software resolves executables, shared libraries, or helper components using a search order that includes a directory a lower-privileged user can write to or influence (for example a relative path, a current-working-directory lookup, or a writable PATH/library directory). When a privileged APROL process or a co-located higher-privileged component subsequently loads a component by name rather than by a trusted absolute path, the attacker-supplied binary executes in that process's context. The single CPE provided (cpe:2.3:a:b&r_industrial_automation_gmbh:aprol:*) confirms the application itself is the vulnerable surface rather than a bundled third-party library, and the vendor tags 'Information Disclosure' and 'Aprol' align with the high confidentiality impact in the CVSS vector.

RemediationAI

Upgrade APROL to Vendor-released patch: R 4.4-01P5 or later, which is the first release that resolves the untrusted search path issue per B&R/ABB advisory SA26P011 (https://br-cws-assets.de-fra-1.linodeobjects.com/SA26P011-661853b7.pdf). If immediate patching of the OT host is not possible, apply compensating controls: restrict interactive and local login on APROL operator/engineering stations to trusted, vetted personnel only (this reduces who can plant a malicious binary but does not remove the flaw); tighten filesystem permissions so that unprivileged users cannot write to directories in the APROL executable/library search path (side effect: may break custom scripts or add-ons that rely on those writable paths, so test on a staging system); and enforce application allowlisting/integrity monitoring on the host to detect or block unauthorized executables (side effect: operational overhead maintaining the allowlist). Because the vector is local, network segmentation of the control network limits which actors can obtain the required foothold but does not by itself mitigate an insider or an already-compromised account.