I'm going through the process of updating the CODESYS Project a machine to 3.5 SP21 (old version was 3.5 SP20). One function that stopped working when upgrading was SysProcessCreate.

I need to run a .exe file that is located in C:\Program Files\MQTTStream. Some initial searching suggested that there are new security rules that prevent the SoftPLC from reading/writing files to outside of its Device folder (located here - C:\Windows\System32\config\systemprofile\AppData\Roaming\CODESYS\CODESYSControlWinV3x64\24FD6770)

Relocating files helped fix my JSON file reader/writer functions (which were failing previously), but not the case for SysProcessCreate.

I've even attempted to just run window's cmd.exe and with:
pszCommandLine = 'cd /d C:\Windows\System32\config\systemprofile\AppData\Roaming\CODESYS\CODESYSControlWinV3x64\24FD6770\PlcLogic\MQTTStream & sift-proxy.exe --grpc_uri="https://grpc-api.siftstack.com" --api_key="xxxxxxxxxxxxxxxxxxx" mqtt-client --broker_ip=10.0.10.101 --broker_port=1883 --config_file="mqtt_telemetry_config.json" --username Plantd --password 1234 --stream_metrics --storage_path="sift-proxy-logs"'

I have not been able to find a lot of documentation on this, and I suspect the new update may have created a bug for SysProcessCreate.

Any help would be greatly appreciated

I ran into something similar after updating to SP21. It’s not really documented well, but the runtime isolation became stricter.
First test something very simple like:
pszApplicationName := 'C:\Windows\System32\notepad.exe';
pszCommandLine := '';

If that fails, it's definitely security context.
Alternative architecture
In some projects we moved the external executable into:
PlcLogic\
and executed it from there only.
Geometry Dash Lite