SA26P015

APROL is intended to be operated only in environments with restricted logical and physical access, as described in the product documentation and in “Defense in Depth for B&R products”. Until patches are available and installed, B&R recommends that customers implement additional security measures to limit access to the product to trusted personnel. We advise customers to review and validate their cur-rent access restrictions to confirm that logical and physical access controls are configured in line with these recommendations. These measures reduce, but may not fully eliminate, the risk of exploitation. It is recommended to block any HTTP(S) traffic, particularly from untrusted networks, reaching the APROL system on your connected firewalls. Refer to section “General security recommendations” for further advise on how to keep your system secure.

APROL is intended to be operated only in environments with restricted logical and physical access, as described in the product documentation and in “Defense in Depth for B&R products”. Until patches are available and installed, B&R recommends that customers implement additional security measures to limit access to the product to trusted personnel. We advise customers to review and validate their cur-rent access restrictions to confirm that logical and physical access controls are configured in line with these recommendations. These measures reduce, but may not fully eliminate, the risk of exploitation. It is recommended to block any HTTP(S) traffic, particularly from untrusted networks, reaching the APROL system on your connected firewalls. Refer to section “General security recommendations” for further advise on how to keep your system secure.

B&R is actively working on patch versions for affected products. Based on current planning, these are expected to be released on October 26, 2026 (for R 4.4-65) and October 29, 2026 (for R 4.4-01). B&R will up-date this advisory if these dates change. APROL is intended to be operated only in environments with restricted logical and physical access, as described in the product documentation and in “Defense in Depth for B&R products”. Until patches are available and installed, B&R recommends that customers restrict HTTP(S) traffic to the APROL system, particularly from untrusted networks, and implement additional security measures to limit access to the product to trusted personnel. We advise customers to review and validate their current access re-strictions to confirm that logical and physical access controls are configured in line with these recom-mendations. These measures reduce, but may not fully eliminate, the risk of exploitation.

B&R is actively working on patch versions for affected products. Based on current planning, these are expected to be released on October 26, 2026 (for R 4.4-65) and October 29, 2026 (for R 4.4-01). B&R will up-date this advisory if these dates change. APROL is intended to be operated only in environments with restricted logical and physical access, as described in the product documentation and in “Defense in Depth for B&R products”. Until patches are available and installed, B&R recommends that customers restrict HTTP(S) traffic to the APROL system, particularly from untrusted networks, and implement additional security measures to limit access to the product to trusted personnel. We advise customers to review and validate their current access re-strictions to confirm that logical and physical access controls are configured in line with these recom-mendations. These measures reduce, but may not fully eliminate, the risk of exploitation.