Johnson Controls Simplex Incident Manager Cleartext Credential Storage Vulnerability
First seen Aug 21, 2026 · Updated Aug 21, 2026 · CVSS 5.8
Johnson Controls Simplex Incident Manager versions up to V2.01 store user credentials, including passwords and authentication tokens, in cleartext within system memory. A local low-privileged attacker could extract these credentials using memory-dumping techniques, potentially gaining unauthorized access to the application and connected building automation systems. Johnson Controls has released patched version v2.01.01 to remediate the issue.
Technical Analysis
CVE-2026-27875 (CWE-316: Cleartext Storage of Sensitive Information in Memory) affects Johnson Controls Simplex Incident Manager <=V2.01, where authentication credentials remain unencrypted in process memory during runtime. Exploitation requires local access and low privileges (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L, base score 5.8, MEDIUM) but no user interaction, allowing an attacker to use memory-dumping tools to harvest credentials for lateral movement or unauthorized system access. The vulnerability is not remotely exploitable and has high attack complexity, reducing the likelihood of widespread automated exploitation; no public exploitation has been reported to CISA as of the advisory date. This is a building/incident management OT product rather than an AI agent framework, and there is no direct evidence of AI agent or LLM tool-use exposure in this advisory, so no agent-specific impact is asserted.
Affected Systems
Johnson Controls Simplex Incident Manager version <=V2.01 (fixed in v2.01.01); deployed across critical manufacturing, commercial facilities, government services, transportation systems, and energy sector environments worldwide.
Indicators of Compromise
- None published — this is a vulnerability disclosure, not an active exploitation campaign report.
Remediation Steps
- 1
Upgrade Software
Update Johnson Controls Simplex Incident Manager to version v2.01.01 or later, which addresses the cleartext credential storage issue.
- 2
Restrict Local Access
Limit local access to systems running Simplex Incident Manager to authorized personnel only, enforcing least-privilege principles.
- 3
Deploy Endpoint Monitoring
Implement endpoint protection and monitoring to detect memory-dumping tools or other suspicious local processes targeting credential extraction.
- 4
Enable Disk Encryption
Utilize full-disk encryption and secure boot mechanisms to mitigate risks from offline memory or disk analysis attacks.
- 5
Audit and Log Access
Monitor for unauthorized local access attempts and enable audit logging to detect potential exploitation attempts.
- 6
Review Vendor Advisory
Consult Johnson Controls Product Security Advisory JCI-PSA-2026-28 for detailed mitigation guidance specific to this vulnerability.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.