OTPulse

APROL Impact of PHP2Shell

Act NowCVSS 9.8sa26p015Oct 23, 2026
Manufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

ABB APROL automation systems are vulnerable to arbitrary code execution via a flaw in HTTP/HTTPS request handling. An unauthenticated attacker with network access can send a crafted request to inject and execute arbitrary code, potentially compromising the affected system. Affected versions are APROL R 4.4-65 and R 4.4-01. B&R is developing patches expected in late October 2026. Until patches are available, the vendor recommends restricting network access and implementing access controls per product documentation.

What this means
What could happen
An attacker with network access to APROL could run arbitrary code on the system, potentially altering process parameters, halting production, or corrupting data on manufacturing equipment managed by APROL.
Who's at risk
Manufacturing facilities using ABB APROL process automation systems, particularly those versions R 4.4-65 and R 4.4-01 that manage industrial processes, production sequencing, or control setpoints on manufacturing equipment.
How it could be exploited
An attacker sends a crafted HTTP/HTTPS request to the APROL web interface without authentication. The request exploits a code injection flaw that allows execution of arbitrary commands on the APROL system. No special credentials or user interaction is required.
Prerequisites
  • Network access to APROL HTTP/HTTPS ports (typically 80 or 443)
  • APROL system reachable from untrusted networks or the internet
  • No authentication required
remotely exploitableno authentication requiredlow complexityhigh EPSS score (11.6%)affects production control systems
Exploitability
Likely to be exploited — EPSS score 11.6%
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (1)
ProductAffected VersionsFix Status
APROL <=R 4.4-65≤ R 4.4-65Fix available
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDBlock all HTTP and HTTPS traffic to APROL from untrusted networks using your network firewall, allowing access only from engineering workstations and maintenance systems on trusted subnets
HARDENINGVerify that logical and physical access controls to APROL are configured per vendor documentation (restricted to authorized personnel only)
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HARDENINGDocument and monitor which systems and users have network access to APROL to detect unauthorized connection attempts
HOTFIXPlan maintenance windows and apply vendor patch when released (expected October 26, 2026 for R 4.4-65 and October 29, 2026 for R 4.4-01)
View full ABB PSIRT advisory
API: /api/v1/advisories/4c9a384e-85a3-475d-a2fc-2e21886e792d

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.