ABB Warns APROL R 4.4-65 and Earlier Are Exposed to PHP2Shell
Tech GuruQuick Answer
ABB advisory SA26P015 says APROL R 4.4-65 and earlier are affected by CVE-2026-109618 and CVE-2026-109619. Block untrusted HTTP(S), restrict system access, track the planned patches, validate controls, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory APROL systems, exact releases, nodes, HTTP(S) paths, network zones, remote-access routes, owners, backups, and maintenance windows. Match each system to the affected boundary of R 4.4-65 and earlier and validate whether an attacker can reach an APROL node; do not infer Internet exposure from product presence alone. Until supported patches are released and installed, block HTTP(S) traffic to APROL from untrusted networks and limit logical and physical access to trusted personnel as ABB directs; monitor SA26P015 for the final patch builds. Confirm firewall and access-control enforcement, test required operator and engineering workflows, capture the exact APROL release, verify vendor patch availability before change, and retain sanitized evidence.
Last verified: 2026-10-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | B&R APROL process-control systems |
|---|---|
| Advisory | SA26P015 |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Authoritative release date | 2026-10-23 00:30:00 UTC |
| Authority revision date | 2026-10-23 01:30:00 UTC |
| Affected versions | B&R APROL R 4.4-65 and earlier. Exploitation requires network access to an affected system node; ABB says crafted messages can lead to arbitrary code execution. |
| Fixed version | No fixed version is identified in revision 2; B&R plans patches for R 4.4-65 on October 26, 2026 and R 4.4-01 on October 29, 2026 |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | B&R states that it had received no information indicating exploitation in APROL when the advisory was originally issued; no exploitation claim is inferred. |
What Changed
ABB/B&R published APROL-specific exposure for the two PHP2Shell memory-safety vulnerabilities. An attacker with access to the system network can send crafted traffic to an affected node and execute arbitrary code.
What To Validate Now
- Inventory. Inventory APROL systems, exact releases, nodes, HTTP(S) paths, network zones, remote-access routes, owners, backups, and maintenance windows.
- Establish applicability. Match each system to the affected boundary of R 4.4-65 and earlier and validate whether an attacker can reach an APROL node; do not infer Internet exposure from product presence alone.
- Remediate. Until supported patches are released and installed, block HTTP(S) traffic to APROL from untrusted networks and limit logical and physical access to trusted personnel as ABB directs; monitor SA26P015 for the final patch builds.
- Validate. Confirm firewall and access-control enforcement, test required operator and engineering workflows, capture the exact APROL release, verify vendor patch availability before change, and retain sanitized evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The authority gives planned patch dates but does not identify fixed build numbers in revision 2. Do not treat a planned date as an available fix, and test process-control availability and recovery before maintenance.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
