Is CVE-2026-64896 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64896 being exploited in the wild.

How severe is CVE-2026-64896?

Informational severity, published 27 August 2026.

Which products and versions are affected?

Johnson Controls T2000 before 31.6.

Is there a fix for CVE-2026-64896?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-64896 attacked?

It is attacked over the network or from the adjacent network or with local access.

Am I affected by CVE-2026-64896?

Check whether you run Johnson Controls T2000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64896: Johnson Controls T2000 improper access control in debug interface

CVE-2026-64896 · Severity: info · Published 2026-08-27

Johnson Controls T2000 is a building automation and control system used to manage HVAC, fire suppression, and security systems in commercial facilities. A debug and test interface in T2000 lacks proper access controls, potentially allowing unauthorized users to bypass security restrictions and access functionality they should not be able to use, which could disrupt building operations or compromise system integrity.

Vendors: Johnson Controls.

Quick answers

Is CVE-2026-64896 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64896 being exploited in the wild.
How severe is CVE-2026-64896?: Informational severity, published 27 August 2026.
Which products and versions are affected?: Johnson Controls T2000 before 31.6.
Is there a fix for CVE-2026-64896?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-64896 attacked?: It is attacked over the network or from the adjacent network or with local access.
Am I affected by CVE-2026-64896?: Check whether you run Johnson Controls T2000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a debug and test interface with improper access control (CWE-284) in Johnson Controls T2000 building automation system. The debug interface lacks proper authentication or authorization controls, allowing access to functionality that should be restricted by access control lists (ACLs). An attacker with network or local access to the T2000 system could potentially invoke debug or test functions without proper credentials, bypassing normal security constraints. The vulnerability affects versions before 31.6; patched versions are available in 31.6 and later.

Affected products

Johnson Controls T2000 before 31.6

Timeline

2026-08-27: disclosed

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.