# CVE-2026-71456: Johnson Controls Kantech Entrapass hard-coded cryptographic key

Source: https://junglewise.ai/threats/cve-2026-71456-use-of-hard-coded-cryptographic-key-vulnerability-in-johnson  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-71456 · Severity: info · Published 2026-10-26

Johnson Controls Kantech Entrapass is an access control system used to manage building entry and security. A hard-coded encryption key in the system allows attackers to decrypt sensitive data through a padding oracle attack, potentially exposing credentials and access control information without requiring authentication.

Vendors: [Johnson Controls](https://junglewise.ai/threats/vendors/johnson-controls).

## Quick answers

**Is CVE-2026-71456 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71456 being exploited in the wild.

**How severe is CVE-2026-71456?** Informational severity, published 26 October 2026.

**Which products and versions are affected?** Johnson Controls Kantech Entrapass before 9.20.

**Is there a fix for CVE-2026-71456?** Yes: fixed in 9.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71456 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-71456?** Check whether you run Johnson Controls Kantech Entrapass at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.20

## Technical details

The vulnerability involves a hard-coded cryptographic key used in the access control system, enabling a padding oracle cryptographic attack to decrypt encrypted data. The flaw affects Kantech Entrapass before version 9.20 and requires network access to exploit, but does not require authentication or user interaction. An attacker can leverage this to extract sensitive information stored in encrypted form.

## Affected products

- Johnson Controls Kantech Entrapass before 9.20

## Timeline

- 2026-10-26: disclosed

## References

- [https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)

## Related threats

- [Johnson Controls Kantech Entrapass cleartext storage of sensitive data in memory](https://junglewise.ai/threats/cve-2026-71455-cleartext-storage-of-sensitive-information-in-memory)