Johnson Controls Simplex Incident Manager: 1 CVE, Medium 5.8
Summary
CISA reports 1 vulnerability in Johnson Controls Simplex Incident Manager. Weakness type: Cleartext Storage of Sensitive Information in Memory. Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system memory, potentially leading to unauthorized access to the application and connected systems. Highest CVSS v3 score: 5.8 (Medium), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- Johnson Controls
- Products
- Simplex Incident Manager
- CVEs
- CVE-2026-27875
- Highest CVSS v3
- 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
- Deployed
- Worldwide
- Vendor HQ
- Ireland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-27875 | Cleartext Storage of Sensitive Information in Memory | 5.8 | – | No | The Simplex Incident Manager application stores user credentials (such as passwords and authentication tokens) in an unencrypted form within system memory while running. This exposes sensitive information to potential extraction by anyone with local access to the system, including attackers leveraging memory-dumping tools or insiders with elevated privileges. |
Affected products (1)
- Johnson Controls Simplex Incident Manager: <=V2.01
Vendor fixes and mitigations (from advisory)
- Mitigation: Johnson Controls has released a patched version (v2.01.01) to address this vulnerability. To help reduce the risk of exploitation, Johnson Controls suggests considering the following defensive measures: Upgrade the Simplex Incident Manager to version v1.01.05 or later. Restrict local access to systems running the Simplex Incident Manager to authorized personnel only. Implement endpoint protection and monitoring to detect memory-dumping tools or suspicious processes. Enforce strong access control policies and the principle of least privilege on host systems. Utilize full-disk encrypti
- Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-28. link
- Mitigation: Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.