Is CVE-2026-34494 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34494 being exploited in the wild.

How severe is CVE-2026-34494?

Informational severity, published 1 October 2026.

Which products and versions are affected?

Johnson Controls Neo Series MVP2 before 3.3b63.

Is there a fix for CVE-2026-34494?

Yes: fixed in 3.3b63. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34494 attacked?

It is attacked with physical access, in a network appliance.

Am I affected by CVE-2026-34494?

Check whether you run Johnson Controls Neo Series MVP2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34494: Johnson Controls Neo Series MVP2 on-chip debug interface information disclosure

CVE-2026-34494 · Severity: info · Published 2026-10-01

Johnson Controls Neo Series MVP2 is a building automation controller used in HVAC and facility management systems. An on-chip debug interface vulnerability allows attackers with physical access to extract sensitive data from common system memory locations, potentially compromising system configuration and credentials stored on the device.

Vendors: Johnson Controls.

Quick answers

Is CVE-2026-34494 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34494 being exploited in the wild.
How severe is CVE-2026-34494?: Informational severity, published 1 October 2026.
Which products and versions are affected?: Johnson Controls Neo Series MVP2 before 3.3b63.
Is there a fix for CVE-2026-34494?: Yes: fixed in 3.3b63. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34494 attacked?: It is attacked with physical access, in a network appliance.
Am I affected by CVE-2026-34494?: Check whether you run Johnson Controls Neo Series MVP2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.3b63

Technical details

An on-chip debug interface (JTAG or similar hardware debug port) on the Neo Series MVP2 lacks proper access controls, allowing an attacker with physical access to the device to read data from standard memory locations. The vulnerability requires direct physical connection to the debug interface and permits extraction of configuration, credentials, or other sensitive data stored in flash or RAM. A fix is available in version 3.3b63 and later.

Affected products

Johnson Controls Neo Series MVP2 before 3.3b63

Timeline

2026-10-01: disclosed

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.