CISA released ICSA-26-232-01 on August 20, 2026, disclosing a cleartext credential storage vulnerability in Johnson Controls’ Simplex Incident Manager, a fire alarm and life-safety incident coordination application deployed alongside Simplex networked fire and mass-notification systems. The advisory is a republication of Johnson Controls’ own Product Security Advisory JCI-PSA-2026-28, and it affects a single tracked CVE with a CVSS 3.1 base score of 5.8 (medium).
While Simplex Incident Manager itself sits closer to life-safety and building-management infrastructure than classic process-control SCADA, it is frequently deployed on the same converged OT/building-automation networks that also host fire panels, access control, and mass-notification integrations across critical manufacturing plants, transportation hubs, energy facilities, and commercial campuses. Credential exposure on these hosts matters because Incident Manager workstations often hold accounts with elevated access into connected fire, security, and notification subsystems.
Vulnerability Details: CVE-2026-27875
Affected product: Johnson Controls Simplex Incident Manager
Affected versions: Simplex Incident Manager ≤V2.01
Vendor: Johnson Controls Inc. (headquartered in Ireland)
CWE: CWE-316 — Cleartext Storage of Sensitive Information in Memory
CVSS 3.1: 5.8 (Medium) — AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS 4.0: 5.8 (Medium) — CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Deployment: Worldwide, across Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, and Energy sectors
According to CISA’s advisory, the Simplex Incident Manager application stores user credentials — passwords and authentication tokens — in unencrypted form within system memory while the application is running. Any process or user with local access to the host, including standard memory-dumping utilities, can extract these credentials from RAM. Because the CVSS confidentiality impact is rated High while integrity and availability impacts are rated Low, the primary consequence is credential theft rather than direct process manipulation — but stolen credentials from an incident-management workstation can be reused to pivot into connected fire panel networks, mass-notification consoles, or other Simplex-integrated systems.
Exploitability
CISA is explicit that this vulnerability is not remotely exploitable. The attack vector is local (AV:L), attack complexity is high (AC:H), and the attacker needs low privileges (PR:L) already on the host to read process memory. No user interaction is required once local access is obtained. CISA states no known public exploitation targeting this vulnerability has been reported as of the advisory’s release. That combination — local-only, high complexity, no known exploitation — keeps the severity at medium rather than critical, but it should not be read as low-priority: incident-manager hosts are frequently shared, lightly monitored security-operations terminals where “local access” is easier to obtain than on a hardened engineering workstation, whether through a compromised remote-support session, a malicious insider, or lateral movement from an adjacent IT segment.
Mitigations
Johnson Controls has released version 2.01.01, which addresses the cleartext-storage issue, and recommends organizations running Simplex Incident Manager:
- Upgrade to the patched release referenced in JCI-PSA-2026-28 as soon as change control allows.
- Restrict local access to Incident Manager hosts to authorized personnel only.
- Deploy endpoint protection and monitoring capable of flagging memory-dumping tools (e.g., process-dump utilities, LSASS-style scrapers adapted for other processes) or other suspicious local activity.
- Enforce least-privilege access control on the host operating system — the vulnerability requires low privileges to exploit, so tightening who can log in locally directly reduces exposure.
- Apply full-disk encryption and secure boot to reduce the value of offline memory or disk analysis if a device is lost, stolen, or imaged.
- Enable audit logging and alert on unauthorized local logon attempts to Incident Manager systems.
CISA also points operators to its general defense-in-depth guidance for control systems and to Johnson Controls’ security advisory portal (trust center) for the full patch notes tied to JCI-PSA-2026-28.
Why It Matters for OT/ICS Operators
Simplex Incident Manager is typically installed on workstations that already have privileged connectivity into fire detection, mass-notification, and access-control subsystems — the kind of converged building-automation layer that increasingly bridges enterprise IT and OT segments in manufacturing plants, transit facilities, and energy sites. A cleartext-credential exposure on that layer is a textbook lateral-movement enabler: an attacker who gains even brief local access to an Incident Manager terminal (through a shared kiosk account, a stolen laptop, or a compromised remote-support tool) can harvest reusable credentials without needing to defeat encryption or exploit a separate flaw. Asset owners running Simplex deployments should treat this less as an isolated life-safety patch and more as a prompt to audit who has local logon rights to any shared security-operations or incident-response terminal, and to verify those hosts are covered by the same endpoint monitoring applied to engineering workstations elsewhere on the OT network.
CISA has not added CVE-2026-27875 to its Known Exploited Vulnerabilities catalog, and there is no evidence of in-the-wild exploitation at this time. Organizations should nonetheless prioritize the update given the sensitivity of the systems Incident Manager typically touches, and should track further guidance from Johnson Controls’ Product Security Advisory JCI-PSA-2026-28.