# CVE-2026-6901: B&R APROL untrusted search path vulnerability

Source: https://junglewise.ai/threats/cve-2026-6901-b-r-aprol-untrusted-search-path-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-6901 · Severity: high · CVSS 7.7 · Published 2026-07-06

B&R APROL, a process control system used in industrial automation, is affected by a security flaw that could allow an attacker to execute unauthorized code. By placing a malicious file in a specific location on the system, an attacker could trick the software into running it with elevated privileges. This could lead to a full compromise of the automation system, potentially impacting production data and operational integrity.

Vendors: [B&R Industrial Automation](https://junglewise.ai/threats/vendors/b-r-industrial-automation).

## Quick answers

**Is CVE-2026-6901 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6901 being exploited in the wild.

**How severe is CVE-2026-6901?** High severity, with a CVSS score of 7.7, published 6 July 2026.

**Which products and versions are affected?** B&R Industrial Automation APROL before R 4.4-01P5.

**Is there a fix for CVE-2026-6901?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6901 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-6901?** Check whether you run B&R Industrial Automation APROL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Untrusted Search Path vulnerability (CWE-426) exists in B&R Industrial Automation GmbH APROL versions prior to R 4.4-01P5. The application fails to properly validate or sanitize the search path used to locate and load external resources or libraries. A local attacker with file system access can exploit this by placing a malicious binary or library in a directory that is searched before the legitimate one. Successful exploitation allows for arbitrary code execution with the privileges of the APROL process. The issue is resolved in version R 4.4-01P5.

## Affected products

- B&R Industrial Automation GmbH APROL before R 4.4-01P5

## Timeline

- 2026-07-06: advisory: Initial publication of the advisory and CVE record.

## References

- [https://br-cws-assets.de-fra-1.linodeobjects.com/SA26P011-661853b7.pdf](https://br-cws-assets.de-fra-1.linodeobjects.com/SA26P011-661853b7.pdf)

## Related threats

- [B&R Industrial Automation APROL improper certificate validation](https://junglewise.ai/threats/cve-2026-6900-b-r-industrial-automation-aprol-improper-certificate-validation)