# CVE-2026-6900: B&R Industrial Automation APROL improper certificate validation

Source: https://junglewise.ai/threats/cve-2026-6900-b-r-industrial-automation-aprol-improper-certificate-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-6900 · Severity: high · CVSS 7.4 · Published 2026-07-06

B&R APROL, a process control system used in industrial automation, contains a security flaw in how it verifies digital certificates. This vulnerability could allow an attacker to intercept or modify sensitive data transmitted between systems by masquerading as a trusted entity. If exploited, this could lead to the unauthorized disclosure of operational data or the manipulation of system commands, potentially impacting industrial processes.

Vendors: [B&R Industrial Automation](https://junglewise.ai/threats/vendors/b-r-industrial-automation).

## Quick answers

**Is CVE-2026-6900 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6900 being exploited in the wild.

**How severe is CVE-2026-6900?** High severity, with a CVSS score of 7.4, published 6 July 2026.

**Which products and versions are affected?** B&R Industrial Automation APROL before R 4.4-01P5.

**Is there a fix for CVE-2026-6900?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6900 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-6900?** Check whether you run B&R Industrial Automation APROL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Improper Certificate Validation (CWE-295) exists in B&R Industrial Automation GmbH APROL versions prior to R 4.4-01P5. The software fails to adequately validate the authenticity of digital certificates during secure communications. An unauthenticated remote attacker could exploit this by performing a man-in-the-middle (MitM) attack to intercept, decrypt, or alter encrypted traffic between the APROL system and other endpoints. While the attack requires a specific network position (High Attack Complexity), a successful exploit results in high impacts to confidentiality and integrity. Users are advised to upgrade to version R 4.4-01P5 or later.

## Affected products

- B&R Industrial Automation GmbH APROL before R 4.4-01P5

## Timeline

- 2026-07-06: advisory: Initial advisory published by ABB/B&R Industrial Automation
- 2026-07-06: disclosed: CVE-2026-6900 published to NVD

## References

- [https://br-cws-assets.de-fra-1.linodeobjects.com/SA26P011-661853b7.pdf](https://br-cws-assets.de-fra-1.linodeobjects.com/SA26P011-661853b7.pdf)

## Related threats

- [B&R APROL untrusted search path vulnerability](https://junglewise.ai/threats/cve-2026-6901-b-r-aprol-untrusted-search-path-vulnerability)