Advisories › Johnson Controls › ICSA-26-225-03
Johnson Controls Inc. Airwall: 2 CVEs, Medium 6.8
Summary
CISA reports 2 vulnerabilities in Johnson Controls Airwall. Weakness types: Use of Hard-coded Cryptographic Key, External Control of File Name or Path. Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining unauthorized access to read arbitrary files on the system, or gain unauthorized access to protected system resources. Highest CVSS v3 score: 6.8 (Medium), not remotely exploitable per its CVSS vector.
What to do: Plan: To help reduce risk of exploitation, Johnson Controls recommends the following defensive measures: Apply v4.1.0 or later patches for all Airwalls.
At a glance
- Vendor
- Johnson Controls
- Products
- Airwall
- CVEs
- CVE-2026-64887, CVE-2026-34492
- Highest CVSS v3
- 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
- Deployed
- Worldwide
- Vendor HQ
- Ireland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-64887 | Use of Hard-coded Cryptographic Key | 6.8 | – | No | A hardcoded password or cryptographic key was identified in the Airwall application. A hardcoded credential leads to a significant authentication failure that can be difficult for system or application administrators to detect. Once discovered, it is difficult to remediate without manually modifying or patching the software. The hardcoded key is identical across all installations of the product an… |
| CVE-2026-34492 | External Control of File Name or Path | 6.4 | – | No | An arbitrary file read vulnerability was identified in the Airwall application. This issue occurs when user-supplied input is directly incorporated into filesystem access functions without adequate validation or sanitization. As a result, an attacker can request and obtain the contents of arbitrary files on the server, including sensitive configuration files, source code, credential stores, and pr… |
Affected products (1)
- Johnson Controls Inc. Airwall: <=4.0.4
Vendor fixes and mitigations (from advisory)
- Mitigation: To help reduce risk of exploitation, Johnson Controls recommends the following defensive measures: Apply v4.1.0 or later patches for all Airwalls.
- Mitigation: Store all cryptographic keys in a secure key management system (KMS) or hardware security module (HSM) rather than embedding them in source code or configuration files. (CVE-2026-64887)
- Mitigation: Implement a regular key rotation policy to limit the exposure window if a key is compromised. (CVE-2026-64887)
- Mitigation: Use unique cryptographic keys per device, installation, or deployment instance to prevent a single compromised key from affecting all installations. (CVE-2026-64887)
- Mitigation: Remove any hard-coded keys from source code repositories and binaries, replacing them with references to secure external key stores. (CVE-2026-64887)Apply the principle of least privilege to key access, ensuring only authorized processes and personnel can retrieve cryptographic material. (CVE-2026-64887)
- Mitigation: Use static analysis and secrets-scanning tools in CI/CD pipelines to detect and prevent hard-coded keys from being committed to source control. (CVE-2026-64887)
- Mitigation: Encrypt keys at rest and in transit and ensure key-wrapping mechanisms are in place for any keys stored on disk. (CVE-2026-64887)
- Mitigation: Audit and monitor access to cryptographic keys, logging all retrieval and usage events for anomaly detection. (CVE-2026-64887)
- Mitigation: Refer to and follow all steps in the product hardening guide or the JCI universal hardening guide found here https://www.johnsoncontrols.com/trust-center/cybersecurity/resources (CVE-2026-64887) link
- Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-25 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories (CVE-2026-64887) link
- Mitigation: Validate and sanitize all user-supplied input before using it in file system operations (CVE-2026-34492)
- Mitigation: Implement strict allowlists for permitted file paths, file names, and directories (CVE-2026-34492)
- Mitigation: Use canonicalization to resolve path traversal sequences before validation (CVE-2026-34492)
- Mitigation: Apply the principle of least privilege to the application file system access permissions (CVE-2026-34492)
- Mitigation: Deploy sandboxing or chroot jails to restrict the application's file system scope (CVE-2026-34492)
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.