The Cybersecurity and Infrastructure Security Agency warned that a vulnerability in Johnson Controls Simplex Incident Manager could let a low-privileged local attacker extract passwords and authentication tokens from system memory, potentially enabling unauthorized access to the application and connected systems. CISA’s advisory, published Aug. 20, identifies the flaw as CVE-2026-27875.
The application stores user credentials in unencrypted form in system memory while it is running. An attacker who already has local access to a host could potentially retrieve those credentials with memory-dumping tools. CISA also identifies insiders with elevated privileges as a possible source of that access.
The vulnerability carries a CVSS base score of 5.8, rated medium under both CVSS version 3.1 and version 4.0. Its scoring reflects a local attack path, high attack complexity and a requirement for low-level privileges. The advisory assigns the weakness to CWE-316, which covers cleartext storage of sensitive information in memory.
CISA said the issue is not remotely exploitable and that no known public exploitation specifically targeting it had been reported to the agency when the advisory was published. Those limitations reduce the conditions under which an attacker could use the flaw, but a successful compromise of a system running the application could expose credentials used to reach the application or connected systems.
Johnson Controls has released patched version 2.01.01, according to the advisory. The mitigation text also tells users to upgrade Simplex Incident Manager to version 1.01.05 or later. Organizations using the product should consult Johnson Controls Product Security Advisory JCI-PSA-2026-28 for detailed instructions before selecting and deploying an update.
Until systems are updated, the recommended controls focus on limiting access to hosts running Simplex Incident Manager and detecting attempts to extract memory. Johnson Controls advises restricting local access to authorized personnel, applying least-privilege controls, using endpoint protection and monitoring for memory-dumping tools or suspicious processes, and maintaining audit logs for unauthorized local-access attempts.
The advisory also recommends full-disk encryption and secure boot to reduce the risk of offline memory analysis. CISA urges affected organizations to perform an impact analysis and risk assessment before deploying defensive measures, while following established internal procedures and reporting suspected malicious activity to the agency for tracking and correlation.
The product is associated in the advisory with critical manufacturing, commercial facilities, government services and facilities, transportation systems, and energy sectors. CISA lists deployment as worldwide and says Johnson Controls reported the vulnerability to the agency. The next operational step for affected users is to identify installations, apply the vendor’s remediation guidance, and monitor systems for suspicious local activity.