Johnson Controls Simplex Incident Manager
view advisory published 2026-08-20
Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system memory, potentially leading to unauthorized access to the application and connected systems.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27875US | — | — | ||
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embed… | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-26-232-01 JSONself
- ICSA Advisory ICSA-26-232-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (1)
- MitigationSimplex Incident Manager
Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan