# CVE-2026-34492: Johnson Controls Airwall path traversal vulnerability

Source: https://junglewise.ai/threats/cve-2026-34492-johnson-controls-airwall-path-traversal-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-34492 · Severity: info · Published 2026-08-14

Johnson Controls Airwall is a network security appliance used to protect building automation and control systems. An attacker with access to the device could manipulate file paths to read, write, or delete files outside intended directories, potentially compromising system integrity or gaining unauthorized access to sensitive configurations.

Vendors: [Johnson Controls](https://junglewise.ai/threats/vendors/johnson-controls).

## Quick answers

**Is CVE-2026-34492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34492 being exploited in the wild.

**How severe is CVE-2026-34492?** Informational severity, published 14 August 2026.

**Which products and versions are affected?** Johnson Controls Airwall before 4.1.

**Is there a fix for CVE-2026-34492?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-34492 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-34492?** Check whether you run Johnson Controls Airwall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as external control of file name or path (CWE-73 or similar), allowing an attacker to manipulate file path operations in Airwall. The vulnerability affects versions before 4.1. Although the reported severity is marked as "info," the vulnerability class (file manipulation through path traversal) could enable attackers to read sensitive files, overwrite system files, or escalate privileges depending on the application's execution context and file permissions. Attack vectors and specific preconditions (authentication requirement, network reachability) are not detailed in the advisory. Patches should be available in version 4.1 and later.

## Affected products

- Johnson Controls Airwall before 4.1

## Timeline

- 2026-08-14: disclosed

## References

- [https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)

## Related threats

- [Johnson Controls Airwall hard-coded cryptographic key](https://junglewise.ai/threats/cve-2026-64887-johnson-controls-airwall-hard-coded-cryptographic-key)