Skip to content
OpenAdvisories
Critical SA26P011 6 CVEs

Security Issues addressed in APROL R 4.4-01P5

Published Jul 6, 2026 · Updated Jul 6, 2026

Vendor: B&R Industrial Automation Product: APROL

Summary

An update is available that resolves several vulnerabilities and updates one or more 3rd party components in the product versions listed as affected in the advisory.

An attacker who successfully exploited these vulnerabilities could impact the availability of the product, spoof identities or elevate privileges.

Vulnerabilities 6

  • Critical 9.8
    CVE-2024-50379 Public exploit EPSS 32%

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  • Critical 9.8
    CVE-2024-56337

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CV…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  • High 7.7
    CVE-2026-6901

    Untrusted Search Path

    Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.

    B&R Industrial Automation APROL
  • High 7.4
    CVE-2026-6900

    Improper Certificate Validation

    Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.

    B&R Industrial Automation APROL
  • Medium 6.5
    CVE-2024-52317 Public exploit

    Apache Tomcat: Request/response mix-up with HTTP/2

    Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 throug…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat10 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2024-54677

    Apache Tomcat: DoS in examples web application

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

Revision history

  1. #1

    Initial version.

References