Is CVE-2026-34498 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34498 being exploited in the wild.

How severe is CVE-2026-34498?

Informational severity, published 6 October 2026.

Which products and versions are affected?

Johnson Controls Illustra Standard - L4L China before 6.0.0.66394.

Is there a fix for CVE-2026-34498?

Yes: fixed in 6.0.0.66394. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34498 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34498?

Check whether you run Johnson Controls Illustra Standard - L4L China at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34498: Johnson Controls Illustra Standard OS command injection via improper input validation

CVE-2026-34498 · Severity: info · Published 2026-10-06

Johnson Controls Illustra Standard is a surveillance and access control system used to secure buildings and facilities. An improper input validation vulnerability allows attackers to execute arbitrary operating system commands on affected Windows systems, potentially leading to full system compromise, unauthorized access to surveillance footage, or disruption of security monitoring.

Vendors: Johnson Controls.

Quick answers

Is CVE-2026-34498 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34498 being exploited in the wild.
How severe is CVE-2026-34498?: Informational severity, published 6 October 2026.
Which products and versions are affected?: Johnson Controls Illustra Standard - L4L China before 6.0.0.66394.
Is there a fix for CVE-2026-34498?: Yes: fixed in 6.0.0.66394. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34498 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34498?: Check whether you run Johnson Controls Illustra Standard - L4L China at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.0.0.66394

Technical details

The vulnerability is an OS command injection flaw resulting from improper input validation in Johnson Controls Illustra Standard - L4L China running on Windows. The attack vector and preconditions are not detailed in available information, but successful exploitation would allow execution of arbitrary commands with the privileges of the affected application. A fix is available in version 6.0.0.66394 and later.

Affected products

Johnson Controls Illustra Standard - L4L China before 6.0.0.66394

Timeline

2026-10-06: disclosed

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.