Johnson Controls vulnerabilities

CVE-2026-34499 High · 8.5 CWE-321 Oct 7, 2026

Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read…

Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10.

CVE-2026-34498 Medium · 5.1 CWE-20 Oct 6, 2026

L4L

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394.

CVE-2026-34491 Medium · 6.1 CWE-79 Aug 24, 2026

Improper neutralization of input during web page generation ('cross-site scripting')...

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

CVE-2026-27875 Medium · 6.9 CWE-316 Aug 21, 2026

Simplex Incident Manager Clear Test

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05.

CVE-2026-34497 Medium · 5.4 CWE-80 Jul 31, 2026

Improper neutralization of Script-Related HTML tags in a web page (basic XSS)…

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.

CVE-2026-34495 Medium · 5.4 CWE-79 Jul 31, 2026

Cross-site Scripting (XSS) in Johnson Controls Fms Employee

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.

CVE-2026-34490 Medium · 5.5 CWE-312 Jul 31, 2026

Cleartext Storage of Sensitive Information in Johnson Controls Xaap

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.

CVE-2026-21662 Critical · 9.8 CWE-434 Jul 31, 2026

Unrestricted Upload of File with Dangerous Type in Johnson Controls Fms Employee

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.

CVE-2026-34496 High · 7.1 CWE-269 Jul 23, 2026

victor Web - Priviledge Escalation

Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1.

CVE-2026-21655 High · 8.7 CWE-502 Jul 23, 2026

C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

CVE-2026-21653 High · 7.2 CWE-918 Jul 23, 2026

CCure and Victor Application Server - Server Side Request Forgery

Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.

CVE-2026-21661 High · 8.4 CWE-427 May 6, 2026

AC2000 Uncontrolled Search Path Element

An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

CVE-2026-21660 Critical · 9.8 CWE-522 Feb 27, 2026

Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21659 Critical · 9.8 CWE-22 Feb 27, 2026

Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21658 Critical · 9.8 CWE-94 Feb 27, 2026

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21657 Critical · 9.8 CWE-94 Feb 27, 2026

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21656 Critical · 9.8 CWE-94 Feb 27, 2026

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2026-21654 Critical · 9.8 CWE-78 Feb 27, 2026

Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVE-2025-26385 Critical · 9.5 CWE-77 Jan 30, 2026

Johnson Controls Metasys - Command Injection in SQL Express Deployments

Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects * Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation, * Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation, * LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1, * System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior, * Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior.

CVE-2025-26386 High · 7.1 CWE-121 Jan 28, 2026

Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool

Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the ICU tool.

CVE-2025-43876 High · 8.7 CWE-78 Dec 24, 2025

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings

Under certain circumstances a successful exploitation could result in access to the device.

CVE-2025-43875 High · 8.7 CWE-78 Dec 24, 2025

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo

Under certain circumstances a successful exploitation could result in access to the device.

CVE-2025-61740 High · 7.2 CWE-346 Dec 22, 2025

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error

Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.

CVE-2025-26379 High · 7.2 CWE-338 Dec 22, 2025

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator

Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.

CVE-2025-61739 High · 7.2 CWE-323 Dec 22, 2025

Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption

Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.