Vulnerabilities

CVSS

7.0 High

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Risk score

56.0

Published

2026-08-14

Status

Published

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1.

Weaknesses

CWE-73

Coverage 1

vulnerability

Johnson Controls Inc. Airwall

Johnson Controls Inc.'s Airwall software versions 4.0.4 and earlier contain critical vulnerabilities. A hardcoded cryptographic key allows attackers to decrypt sensitive data, bypass authentication, and access arbitrary…

CISA Advisories · Aug 13, 2026 High

CVE-2026-64887CVE-2026-34492vulnerabilityhardcoded keypath traversal

All articles mentioning it

Advisories and references

• johnsoncontrols.com/trust-center/cybersecurity/security-advisories