CISA issues advisory on Johnson Controls Simplex Incident Manager credential exposure

The Cybersecurity and Infrastructure Security Agency (CISA) released a security advisory on Aug. 20 2026 identifying vulnerability CVE-2026-27875 in Johnson Controls Simplex Incident Manager versions ≤ V2.01. The flaw, rated CVSS v3 5.8, involves cleartext storage of passwords and authentication tokens in system memory, enabling a local attacker with low privileges to extract credentials from memory.

The advisory notes that Simplex Incident Manager is deployed worldwide in critical infrastructure sectors, including critical manufacturing, commercial facilities, government services and facilities, transportation systems, and energy. The vulnerability is not exploitable remotely; exploitation requires local system access and is characterized by high attack complexity.

CISA recommends that affected organizations conduct impact analyses and risk assessments before implementing defensive measures. Recommended actions include applying the control-systems security practices outlined on the agency's ICS webpage, consulting the technical information paper ICS-TIP-12-146-01B for intrusion detection and mitigation, and following standard social-engineering safeguards such as avoiding unsolicited email links and attachments.

Johnson Controls reported the issue to CISA, and the advisory republishes the Johnson Controls Product Security Advisory JCI-PSA-2026-28. No public exploitation of the vulnerability has been reported. Organizations observing suspicious activity are urged to follow internal procedures and report findings to CISA for tracking and correlation.