The vulnerability identified as CVE-2026-6901 in B&R Industrial Automation GmbH APROL is classified under CWE-426 (Untrusted Search Path). It affects APROL versions prior to R 4.4-01P5. The issue arises from the software's improper handling of search paths for executables or libraries, which can be manipulated by an attacker with local access to execute arbitrary code. The CVSS v3.1 base score is 7.7, reflecting a local attack vector with low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. There is no vendor advisory or patch information available at this time, and the vulnerability is not known to be exploited in the wild.

Successful exploitation could allow an unauthenticated local attacker to execute arbitrary code with the privileges of the affected application, leading to a high impact on confidentiality and integrity of the system. Availability is not impacted. This could result in unauthorized access to sensitive information or unauthorized modification of data within the APROL environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to executable or library loading within APROL. Avoid running APROL on systems where untrusted users have local access.