1. Executive summary
CVE-2026-27875 affects Johnson Controls Simplex Incident Manager V2.01 and earlier, which retain passwords and authentication tokens in cleartext process memory while running. CISA reports CVSS v3.1 5.8 MEDIUM and CVSS v4.0 5.8 MEDIUM; exploitation requires local, low-privileged access, has high attack complexity and is not remotely exploitable. Extracted credentials could permit unauthorised access to Incident Manager and connected systems, making installations that bridge building-management and operational networks the principal concern for EMEA financial institutions. No CISA KEV state was resolved in the supplied reference data; separately, CISA reported no known public exploitation specifically targeting this vulnerability as of 20 August 2026.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The supplied material describes a product vulnerability, not an incident, reportable impact or distinctive third-party concentration condition. Regulated entities should apply their existing incident-classification procedures if exploitation or operational impact is subsequently identified.
3. Technical analysis & attack chain
Vulnerability attack path
The following is the vulnerability path documented by CISA, not an observed intrusion chain:
- Prerequisite access: An attacker first obtains local access to a host running Simplex Incident Manager V2.01 or earlier. The vulnerability is not remotely exploitable and requires low privileges. CISA characterises attack complexity as high.
- Credential exposure: While Incident Manager is running, it retains user passwords and authentication tokens in unencrypted system memory. CISA classifies the weakness as CWE-316: Cleartext Storage of Sensitive Information in Memory.
- Memory acquisition: A locally positioned attacker could use memory-dumping tooling or another process-memory inspection method to extract the exposed material. CISA names the tool category but provides no product names, commands, process names or dump-file paths.
- Credential reuse: Recovered passwords or tokens could be used to obtain unauthorised access to Incident Manager and potentially connected systems. No observed credential reuse, lateral movement or downstream compromise is reported.
Technical scope
| Area | Source-supported assessment |
|---|---|
| Identifier | CVE-2026-27875 |
| Affected product | Johnson Controls Simplex Incident Manager V2.01 and earlier |
| Vulnerable component | The running Incident Manager application’s handling of credentials in system memory |
| Weakness | CWE-316: cleartext storage of sensitive information in memory |
| CVSS v3.1 | 5.8 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L |
| CVSS v4.0 | 5.8 MEDIUM — CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N |
| Initial-access vector | Local access to the affected host; remote exploitation is not supported |
| User interaction | None after the attacker meets the local-access prerequisite |
| Exposed data | User passwords and authentication tokens |
| Payload or malware | None reported |
| Persistence | No persistence mechanism reported |
| Privilege escalation | The flaw does not itself establish privilege escalation; exploitation begins from a low-privileged local context |
| Command and control | None reported |
| Lateral movement | Credential reuse against connected systems is a potential consequence, not an observed action |
| Exfiltration | Credential extraction from memory is possible; no transport or exfiltration mechanism is reported |
| Observed impact | None reported; CISA describes potential unauthorised access to the application and connected systems |
Johnson Controls reportedly released V2.01.01 as the patched version. The same CISA advisory also says to upgrade to V1.01.05 or later; this conflicts with the stated affected range of V2.01 and earlier and with V2.01.01 being identified as the patch. Clients should therefore confirm the supported remediation build against JCI-PSA-2026-28 before deployment.
All technical and exploitation claims are from a single CISA reporting chain that republishes Johnson Controls advisory JCI-PSA-2026-28. They are single-sourced; verify product versions and remediation guidance before enforcement.
4. Mitigation & containment
P1 — within 24 hours
- Inventory all Simplex Incident Manager installations and identify systems running V2.01 or earlier.
- Restrict local interactive and administrative access to affected hosts to specifically authorised personnel. Remove unnecessary accounts and enforce least privilege.
- Limit affected hosts’ connectivity to only required building-automation and management systems. Where operationally safe, isolate installations that cannot immediately be patched.
- Enable and review logging for local logons, failed access attempts, privilege changes and suspicious process execution.
- Deploy or confirm endpoint monitoring capable of detecting process-memory access and memory-dumping activity.
- Obtain JCI-PSA-2026-28 and validate the correct target release with Johnson Controls. Do not rely solely on the conflicting V1.01.05 wording in the CISA republication.
P2 — within 72 hours
- Following operational-impact testing, upgrade affected installations to the vendor-designated patched release, reported by CISA as V2.01.01.
- After remediation, restart the application or host as required by the vendor so credentials retained by the vulnerable process are removed from active memory.
- Rotate passwords and invalidate authentication tokens used through an affected installation where suspicious local access or memory acquisition is identified.
- Review whether credentials used by Incident Manager are shared with connected systems. Replace shared credentials with unique accounts and restrict their permissions.
- Investigate unexpected local sessions, process-memory access and execution of unapproved diagnostic or dumping utilities on affected hosts.
P3 — within seven days
- Enable full-disk encryption and secure boot where supported. These measures reduce offline acquisition risk but do not protect credentials from an attacker operating while the vulnerable application is running.
- Review local administrator and service-account membership on Incident Manager hosts.
- Validate segmentation between Incident Manager, user networks and connected building-automation systems.
- Record the deployed application version and preserve evidence of vendor remediation validation because the public upgrade wording is inconsistent.
- Conduct an impact analysis before production changes, particularly where Incident Manager supports safety, physical-security or facilities operations.
No source-supplied commands, ports, firewall signatures, registry keys or product-specific file paths are available.
5. Indicators of compromise
No atomic indicators of compromise are available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Unexpected use of memory-dumping or process-memory inspection tooling on an Incident Manager host | EDR process telemetry, application-control logs and operating-system audit logs | Low specificity; single-sourced; verify before enforcement |
| Suspicious processes accessing the running Incident Manager application’s memory | EDR process-access telemetry | Moderate relevance but no source-supplied process name or access pattern; single-sourced |
| Unauthorised or anomalous local access to an affected host | Local authentication, remote-administration and physical-access logs | Low specificity; single-sourced |
| Authentication to Incident Manager or connected systems using credentials following suspicious local activity | Application and connected-system authentication logs | Potential downstream behaviour, not observed exploitation; single-sourced |
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- CISA, “Johnson Controls Simplex Incident Manager,” https://www.cisa.gov/news-events/ics-advisories/icsa-26-232-01, 2026-08-20.
- Johnson Controls, “Product Security Advisory JCI-PSA-2026-28” advisory index, https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories, date not stated in the supplied content.
8. Adverse Trace position
Adverse Trace retains CISA’s MEDIUM rating: CVSS v3.1 5.8 and CVSS v4.0 5.8. The local-access requirement, low privileges, high attack complexity and absence of reported public exploitation constrain immediate risk; installations become more consequential where their resident credentials provide access to connected facilities or operational systems. No CISA KEV state was resolved in the supplied reference data, and no attribution or campaign evidence is available. The reporting and behavioural guidance are single-sourced; verify before enforcement. Clients should prioritise access restriction and version discovery, then deploy the vendor-confirmed patched build after resolving the conflicting V2.01.01/V1.01.05 guidance. Adverse Trace will monitor for corrected remediation instructions, a resolved KEV state, exploitation reporting and actionable indicators.
Published via PulseTrace — Adverse Trace threat intelligence.