CVE-2026-6901: Untrusted Search Path in B&R APROL Industrial Automation

Technical summary

CVE-2026-6901 is an untrusted search path vulnerability (CWE-426) in APROL versions prior to R 4.4-01P5. The vulnerability arises from improper control over which directories the application searches when loading shared libraries or dependencies. An attacker with local system access can exploit this by placing a malicious library in a directory that APROL checks before official system paths. Upon execution, the application loads and runs the attacker's code with the privileges of the APROL process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects local attack surface, low complexity, no privilege requirement, no user interaction, and impacts to confidentiality and integrity.

Business impact

APROL is used in industrial automation and process control environments. Successful exploitation could allow a local attacker to extract sensitive process data, modify control logic, or disrupt operational continuity. In manufacturing or critical infrastructure settings, this could result in unplanned downtime, product quality issues, or safety concerns. The attack requires only local access, making insider threats or compromised contractor accounts viable vectors.

Affected systems

B&R Industrial Automation APROL installations running versions prior to R 4.4-01P5 are vulnerable. Organizations should inventory APROL deployments and verify installed version numbers. The vulnerability affects systems regardless of network isolation if local access is possible.

Exploitability

Exploitability is straightforward for a local attacker. The attack requires no special privileges, no user interaction, and minimal complexity—an attacker simply needs to place a malicious library in a predictable search directory. This makes the vulnerability practical for insiders, compromised accounts, or adversaries who have already gained local system access. Remote exploitation is not possible; however, the low barrier to local abuse elevates concern in environments where user segregation is weak.

Remediation

Upgrade APROL to version R 4.4-01P5 or later. Before patching, apply principle of least privilege to file system permissions on directories where APROL searches for libraries, and restrict local account creation or access to systems running APROL. Consider air-gapping or limiting physical/remote access to affected industrial control systems.

Patch guidance

Apply the R 4.4-01P5 patch or any subsequent maintenance release when available. Coordinate patching with your operational technology team to minimize downtime. Verify patch application by confirming the installed version number in the APROL application settings or installation directory. Test in a non-production environment first to ensure compatibility with your process workflows and integrated systems.

Detection guidance

Monitor for unauthorized file creation in APROL library search directories. Log and alert on attempts to write to directories used by APROL for library loading. Track process execution and library loading events to detect loading of unsigned or unexpected libraries. Examine access logs for file system changes in APROL installation and working directories, particularly during periods of unexpected system activity or following privilege escalation attempts.

Why prioritize this

The HIGH CVSS score (7.7) combined with low attack complexity and no privilege requirement justifies elevated priority. Although local access is required, the direct impact to both confidentiality and integrity in an industrial context is significant. Organizations running APROL should patch promptly, especially those where local system access is less tightly controlled. The vulnerability is not on the KEV catalog, but its practical exploitability and industrial focus warrant urgent attention.

Risk score, explained

CVSS 3.1 assigns a score of 7.7 (HIGH severity). The local attack vector (AV:L) limits exposure to attackers with system access. Low attack complexity (AC:L) means exploitation is straightforward. No privilege requirement (PR:N) and no user interaction (UI:N) indicate an unprivileged local user can exploit it directly. High confidentiality (C:H) and integrity impact (I:H) reflect the ability to read sensitive data and modify program execution. The absence of availability impact (A:N) suggests service disruption is not a direct consequence, though data corruption or malicious actions could have indirect effects.

Frequently asked questions