CVE-2026-6900
highEPSS 0.002 · 12 %ileCHEUEPSS · scored 2026-10-18
Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedAPROLabb_psirt
The problem is corrected in the following product versions: - APROL >= R 4.4-01P5 B&R recommends that customers apply the update at earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.
- MitigationAPROLabb_psirt
Refer to section “General security recommendations” for further advise on how to keep your system secure.
- WorkaroundAPROLabb_psirt
Enable TLS Certificate Verification System-Wide Add the following configuration directive to the file /etc/openldap/ldap.conf: TLS_REQCERT demand This tells the LDAP client to require and verify the server's certificate. Configure Certificate Verification for Each User Account Each Linux user account (engineering, runtime, and operator accounts) needs its own configuration file that points to where its issuer certificates are stored. Create a .ldaprc file in the home directory of each account and add the appropriate certificate directory path. For Engineering Accounts: Create /home/<username>/.ldaprc and add: TLS_CACERTDIR /home/<username>/ENGIN/cnf/GLOBAL_ENGINEERING/LDAP/issuers/ For Runtime and Operator Accounts: Create /home/<username>/.ldaprc and add: TLS_CACERTDIR /home/<username>/RUNTIME/cnf/GLOBAL/LDAP/issuers/ Replace <username> with the actual Linux user account name. Prepare the Certificate Directories For each issuer certificate directory you created above, run this command to enable certificate verification: openssl rehash <issuer certificate directory> This command indexes the certificates so the system can find them quickly during verification. Deploy Trusted Certificates When you configure an external LDAP server, manually copy the server's trusted issuer certificate to the appropriate directories you created in “Configure Certificate Verification for Each User Account”.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.9–9.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- SA26P011Security Issues addressed in APROL R 4.4-01P52026-07-06csaf · abb_psirtCH
An update is available that resolves several vulnerabilities and updates one or more 3rd party components in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could impact the availability of the product, spoof identities or elevate privileges.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan