# CVE-2026-34490: Johnson Controls XAAP Application cleartext storage on Android

Source: https://junglewise.ai/threats/cve-2026-34490-johnson-controls-xaap-application-cleartext-storage-on-android  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-34490 · Severity: info · CVSS 4.8 · Published 2026-07-31

The Johnson Controls XAAP application for Android contains a vulnerability where sensitive information is stored in an unencrypted, plain-text format. If a mobile device is lost, stolen, or compromised (such as being jailbroken), an unauthorized person could access this sensitive data. This could lead to the exposure of user credentials or other private operational information.

Vendors: [Johnson Controls](https://junglewise.ai/threats/vendors/johnson-controls).

## Quick answers

**Is CVE-2026-34490 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34490 being exploited in the wild.

**How severe is CVE-2026-34490?** Informational severity, with a CVSS score of 4.8, published 31 July 2026.

**Which products and versions are affected?** Johnson Controls XAAP Application before 1.53.

**Is there a fix for CVE-2026-34490?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-34490 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-34490?** Check whether you run Johnson Controls XAAP Application at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cleartext storage of sensitive information vulnerability (CWE-312) exists in the Johnson Controls XAAP Application on Android. The root cause is the application's failure to encrypt sensitive data before writing it to local storage. An attacker with local access to a jailbroken or otherwise compromised device can bypass standard application sandboxing to read these files. This allows for the retrieval of sensitive data that should be protected. The issue is resolved in version 1.53.

## Affected products

- Johnson Controls XAAP Application before 1.53

## Timeline

- 2026-07-31: advisory: Initial advisory published by Johnson Controls and NVD.

## References

- [https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)