Johnson Controls Airwall Hard-coded Cryptographic Key and Arbitrary File Read Vulnerabilities
First seen Aug 15, 2026 · Updated Aug 15, 2026 · CVSS 7
Johnson Controls Airwall versions 4.0.4 and earlier contain two vulnerabilities: a hard-coded cryptographic key used identically across all deployments, and an arbitrary file read flaw via path traversal. Combined, these could allow an attacker with local access or code/binary access to decrypt sensitive configuration data or read arbitrary files including credential stores and private keys. No public exploitation has been reported, and both flaws require local access or high attack complexity, limiting immediate risk.
Technical Analysis
CVE-2026-64887 (CVSS 3.1: 6.8, CVSS 4.0: 7.0) involves a hard-coded cryptographic key (CWE-321) embedded identically across all Airwall installations, meaning a single key disclosure compromises the encryption protecting sensitive configuration and database data across every customer deployment. CVE-2026-34492 (CVSS 3.1: 6.4, CVSS 4.0: 5.9) is a path traversal/arbitrary file read issue (CWE-73) where unsanitized user input passed to filesystem functions allows retrieval of arbitrary files such as /etc/passwd, credential stores, and private keys, exploitable via traversal sequences or encoded variants. Both vulnerabilities affect Airwall software used for network segmentation and secure remote access in industrial and critical infrastructure environments (patched in v4.1.0+). Attack vectors require local access (AV:L) for the key issue or high attack complexity with user interaction for the file-read issue, and no known public exploitation has been reported. If Airwall network segmentation appliances protect infrastructure hosting AI agent orchestration systems, RAG pipelines, or API gateways, exposure of the hard-coded key or arbitrary file read could allow attackers to extract stored credentials or API keys used by agents connecting through these secure tunnels, indirectly compromising agent-to-service authentication.
Affected Systems
Johnson Controls Inc. Airwall versions <=4.0.4; fixed in v4.1.0 and later
Indicators of Compromise
- No specific IOCs published; no known public exploitation reported at this time
Remediation Steps
- 1
Apply vendor patch
Upgrade all Airwall deployments to v4.1.0 or later as recommended by Johnson Controls.
- 2
Secure key management
Store cryptographic keys in a KMS or HSM rather than embedding them in code; use unique keys per deployment and rotate regularly.
- 3
Input validation and path controls
Validate and sanitize all user-supplied input used in file system operations; implement strict allowlists and canonicalize paths before validation.
- 4
Least privilege and sandboxing
Restrict application file system permissions and consider sandboxing/chroot to limit the scope of any file read vulnerability.
- 5
Network isolation
Minimize internet exposure of control system devices, place them behind firewalls, and isolate OT networks from business networks; use VPNs for remote access.
- 6
Secrets scanning
Use static analysis and secrets-scanning tools in CI/CD pipelines to detect and prevent hard-coded keys from being reintroduced.
- 7
Review vendor advisory
Consult Johnson Controls Product Security Advisories JCI-PSA-2026-18 and JCI-PSA-2026-25 for detailed mitigation instructions.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.