{"schema_version":1,"title":"Johnson Controls vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 14 vulnerabilities in Johnson Controls: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-64896, was published on 27 August 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/johnson-controls","json_url":"https://junglewise.ai/threats/vendors/johnson-controls.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/johnson-controls","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":1,"all_time":14,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":13,"last_365_days":14},"latest":[{"cve":"CVE-2026-64896","epss":0.002,"slug":"cve-2026-64896-johnson-controls-t2000-improper-access-control-in-debug-interface","title":"Johnson Controls T2000 improper access control in debug interface","severity":"info","exploited":false,"published_at":"2026-08-27T17:19:23.82+00:00","url":"https://junglewise.ai/threats/cve-2026-64896-johnson-controls-t2000-improper-access-control-in-debug-interface"},{"cve":"CVE-2026-34491","epss":0.004,"slug":"cve-2026-34491-johnson-controls-metasys-cross-site-scripting-vulnerability","title":"Johnson Controls Metasys cross-site scripting vulnerability","severity":"info","exploited":false,"published_at":"2026-08-24T18:17:00.337+00:00","url":"https://junglewise.ai/threats/cve-2026-34491-johnson-controls-metasys-cross-site-scripting-vulnerability"},{"cve":"CVE-2026-27875","epss":0.0008,"slug":"cve-2026-27875-johnson-controls-simplex-incident-manager-cleartext-storage-of","title":"Johnson Controls Simplex Incident Manager cleartext storage of sensitive information","severity":"info","exploited":false,"published_at":"2026-08-21T18:16:47.943+00:00","url":"https://junglewise.ai/threats/cve-2026-27875-johnson-controls-simplex-incident-manager-cleartext-storage-of"},{"cve":"CVE-2026-64887","epss":0.0016,"slug":"cve-2026-64887-johnson-controls-airwall-hard-coded-cryptographic-key","title":"Johnson Controls Airwall hard-coded cryptographic key","severity":"info","exploited":false,"published_at":"2026-08-14T20:16:55.603+00:00","url":"https://junglewise.ai/threats/cve-2026-64887-johnson-controls-airwall-hard-coded-cryptographic-key"},{"cve":"CVE-2026-34492","epss":0.0043,"slug":"cve-2026-34492-johnson-controls-airwall-path-traversal-vulnerability","title":"Johnson Controls Airwall path traversal vulnerability","severity":"info","exploited":false,"published_at":"2026-08-14T20:16:52.817+00:00","url":"https://junglewise.ai/threats/cve-2026-34492-johnson-controls-airwall-path-traversal-vulnerability"},{"cve":"CVE-2026-27871","epss":0.0027,"slug":"cve-2026-27871-johnson-controls-tl280-weak-cryptographic-algorithm","title":"Johnson Controls TL280 weak cryptographic algorithm","severity":"info","exploited":false,"published_at":"2026-08-14T20:16:52.67+00:00","url":"https://junglewise.ai/threats/cve-2026-27871-johnson-controls-tl280-weak-cryptographic-algorithm"},{"cve":"CVE-2026-34497","cvss":4.8,"slug":"cve-2026-34497-johnson-controls-fm-systems-employee-cross-site-scripting","title":"Johnson Controls FM Systems Employee Cross-Site Scripting","severity":"info","exploited":false,"published_at":"2026-07-31T18:17:14.457+00:00","url":"https://junglewise.ai/threats/cve-2026-34497-johnson-controls-fm-systems-employee-cross-site-scripting"},{"cve":"CVE-2026-34495","cvss":4.8,"slug":"cve-2026-34495-johnson-controls-fm-systems-employee-stored-xss","title":"Johnson Controls FM Systems Employee Stored XSS","severity":"info","exploited":false,"published_at":"2026-07-31T18:17:14.31+00:00","url":"https://junglewise.ai/threats/cve-2026-34495-johnson-controls-fm-systems-employee-stored-xss"},{"cve":"CVE-2026-34490","cvss":4.8,"slug":"cve-2026-34490-johnson-controls-xaap-application-cleartext-storage-on-android","title":"Johnson Controls XAAP Application cleartext storage on Android","severity":"info","exploited":false,"published_at":"2026-07-31T18:17:14.15+00:00","url":"https://junglewise.ai/threats/cve-2026-34490-johnson-controls-xaap-application-cleartext-storage-on-android"},{"cve":"CVE-2026-21662","cvss":4.8,"slug":"cve-2026-21662-johnson-controls-fm-systems-employee-unrestricted-file-upload","title":"Johnson Controls FM Systems Employee unrestricted file upload","severity":"info","exploited":false,"published_at":"2026-07-31T18:17:13.65+00:00","url":"https://junglewise.ai/threats/cve-2026-21662-johnson-controls-fm-systems-employee-unrestricted-file-upload"},{"cve":"CVE-2026-34496","cvss":7.1,"slug":"cve-2026-34496-johnson-controls-victor-web-privilege-escalation-on-windows","title":"Johnson Controls victor Web privilege escalation on Windows","severity":"info","exploited":false,"published_at":"2026-07-23T21:17:03.947+00:00","url":"https://junglewise.ai/threats/cve-2026-34496-johnson-controls-victor-web-privilege-escalation-on-windows"},{"cve":"CVE-2026-21655","cvss":8.7,"slug":"cve-2026-21655-johnson-controls-victor-deserialization-of-untrusted-data-on","title":"Johnson Controls victor Deserialization of Untrusted Data on Windows","severity":"info","exploited":false,"published_at":"2026-07-23T21:17:03.81+00:00","url":"https://junglewise.ai/threats/cve-2026-21655-johnson-controls-victor-deserialization-of-untrusted-data-on"},{"cve":"CVE-2026-21653","cvss":7.2,"slug":"cve-2026-21653-johnson-controls-ccure-9000-and-victor-ssrf-in-victor-component","title":"Johnson Controls CCure 9000 and victor SSRF in Victor component","severity":"info","exploited":false,"published_at":"2026-07-23T21:17:03.653+00:00","url":"https://junglewise.ai/threats/cve-2026-21653-johnson-controls-ccure-9000-and-victor-ssrf-in-victor-component"},{"cve":"CVE-2026-21661","cvss":8.7,"slug":"cve-2026-21661-johnson-controls-cem-ac2000","title":"Johnson Controls CEM AC2000","severity":"high","exploited":false,"published_at":"2026-05-05T12:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-21661-johnson-controls-cem-ac2000"}],"vendor":{"hub":true,"name":"Johnson Controls","slug":"johnson-controls","homepage":"https://www.johnsoncontrols.com/","description":"A multinational conglomerate that produces fire, HVAC, and security equipment for buildings.","url":"https://junglewise.ai/threats/vendors/johnson-controls"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-21661","cvss":8.7,"slug":"cve-2026-21661-johnson-controls-cem-ac2000","title":"Johnson Controls CEM AC2000","severity":"high","exploited":false,"published_at":"2026-05-05T12:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-21661-johnson-controls-cem-ac2000"},{"cve":"CVE-2026-21655","cvss":8.7,"slug":"cve-2026-21655-johnson-controls-victor-deserialization-of-untrusted-data-on","title":"Johnson Controls victor Deserialization of Untrusted Data on Windows","severity":"info","exploited":false,"published_at":"2026-07-23T21:17:03.81+00:00","url":"https://junglewise.ai/threats/cve-2026-21655-johnson-controls-victor-deserialization-of-untrusted-data-on"},{"cve":"CVE-2026-21653","cvss":7.2,"slug":"cve-2026-21653-johnson-controls-ccure-9000-and-victor-ssrf-in-victor-component","title":"Johnson Controls CCure 9000 and victor SSRF in Victor component","severity":"info","exploited":false,"published_at":"2026-07-23T21:17:03.653+00:00","url":"https://junglewise.ai/threats/cve-2026-21653-johnson-controls-ccure-9000-and-victor-ssrf-in-victor-component"},{"cve":"CVE-2026-34496","cvss":7.1,"slug":"cve-2026-34496-johnson-controls-victor-web-privilege-escalation-on-windows","title":"Johnson Controls victor Web privilege escalation on Windows","severity":"info","exploited":false,"published_at":"2026-07-23T21:17:03.947+00:00","url":"https://junglewise.ai/threats/cve-2026-34496-johnson-controls-victor-web-privilege-escalation-on-windows"},{"cve":"CVE-2026-34497","cvss":4.8,"slug":"cve-2026-34497-johnson-controls-fm-systems-employee-cross-site-scripting","title":"Johnson Controls FM Systems Employee Cross-Site Scripting","severity":"info","exploited":false,"published_at":"2026-07-31T18:17:14.457+00:00","url":"https://junglewise.ai/threats/cve-2026-34497-johnson-controls-fm-systems-employee-cross-site-scripting"},{"cve":"CVE-2026-34495","cvss":4.8,"slug":"cve-2026-34495-johnson-controls-fm-systems-employee-stored-xss","title":"Johnson Controls FM Systems Employee Stored XSS","severity":"info","exploited":false,"published_at":"2026-07-31T18:17:14.31+00:00","url":"https://junglewise.ai/threats/cve-2026-34495-johnson-controls-fm-systems-employee-stored-xss"},{"cve":"CVE-2026-34490","cvss":4.8,"slug":"cve-2026-34490-johnson-controls-xaap-application-cleartext-storage-on-android","title":"Johnson Controls XAAP Application cleartext storage on Android","severity":"info","exploited":false,"published_at":"2026-07-31T18:17:14.15+00:00","url":"https://junglewise.ai/threats/cve-2026-34490-johnson-controls-xaap-application-cleartext-storage-on-android"},{"cve":"CVE-2026-21662","cvss":4.8,"slug":"cve-2026-21662-johnson-controls-fm-systems-employee-unrestricted-file-upload","title":"Johnson Controls FM Systems Employee unrestricted file upload","severity":"info","exploited":false,"published_at":"2026-07-31T18:17:13.65+00:00","url":"https://junglewise.ai/threats/cve-2026-21662-johnson-controls-fm-systems-employee-unrestricted-file-upload"},{"cve":"CVE-2026-34492","epss":0.0043,"slug":"cve-2026-34492-johnson-controls-airwall-path-traversal-vulnerability","title":"Johnson Controls Airwall path traversal vulnerability","severity":"info","exploited":false,"published_at":"2026-08-14T20:16:52.817+00:00","url":"https://junglewise.ai/threats/cve-2026-34492-johnson-controls-airwall-path-traversal-vulnerability"},{"cve":"CVE-2026-34491","epss":0.004,"slug":"cve-2026-34491-johnson-controls-metasys-cross-site-scripting-vulnerability","title":"Johnson Controls Metasys cross-site scripting vulnerability","severity":"info","exploited":false,"published_at":"2026-08-24T18:17:00.337+00:00","url":"https://junglewise.ai/threats/cve-2026-34491-johnson-controls-metasys-cross-site-scripting-vulnerability"}],"generated_at":"2026-09-27T03:07:00.185062+00:00","technologies":[{"name":"Johnson Controls FM Systems Employee","slug":"fm-systems-employee","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/fm-systems-employee"}]}