B&R mapp Services CVE-2026-79679

Successful exploitation requires that the target is running mapp Services with the mapp Audit component deployed and that the component is reachable over the network from the attacker's position - the CVSS 4.0 AT:P modifier confirms that not all deployment configurations are equally exposed; instances where mapp Audit is not deployed or is network-isolated may not be reachable. No authentication with valid credentials is required by the attacker; the vulnerability is the weakness of the credentials themselves, allowing authentication without prior authorization. The specific nature of the weakness (hardcoded value, known default, or trivially guessable pattern) is not disclosed in available data - the full advisory PDF may specify whether credential rotation alone is sufficient prior to patching. Impact is realized on downstream industrial systems connected through mapp Services, not on the mapp Services host directly. Exploitation is limited to the pre-6.8.0 version range.

The CVSS 4.0 score of 7.0 reflects a meaningful but not maximum-severity finding, with the AT:P modifier (partial attack target condition) preventing a higher rating despite AV:N/PR:N/UI:N. In an enterprise IT context this would be a moderate concern; in OT/ICS environments the risk calculus shifts significantly - SI:H on industrial systems can mean unauthorized modification of control logic, setpoint manipulation, or audit log tampering to conceal other activity, all with potential physical safety implications. No EPSS data, KEV listing, or public proof-of-concept was available in the input data, so exploitation probability cannot be numerically quantified; however, weak credential vulnerabilities in OT software historically require only low attacker sophistication once the credential pattern is discovered. The vendor advisory was issued by ABB/B&R and the fix is confirmed available (6.8.0), supporting a straightforward patch-driven remediation path. The specific nature of the weakness (hardcoded, default, or short credentials) is not disclosed in available data and could substantially affect exploitability - the full advisory PDF at SA26P012 likely contains this detail.

An attacker with network access to an industrial automation network running B&R mapp Services (pre-6.8.0) identifies the weak or default credentials associated with the mapp Audit component - either through prior knowledge of the credential pattern, documentation review, or low-effort brute force. Using those credentials, the attacker authenticates to or impersonates the mapp Audit service, gaining high-integrity access to downstream industrial systems connected through mapp Services to tamper with audit records, modify control configurations, or pivot further into the OT environment. No public exploit code has been identified at time of analysis.