Johnson Controls Airwall hardcoded key, path traversal flaws
Johnson Controls Airwall ≤4.0.4 has a hardcoded cryptographic key and an arbitrary file read flaw that could let attackers decrypt data or read sensitive files.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory for Johnson Controls Airwall versions 4.0.4 and earlier, detailing two vulnerabilities. CVE-2026-64887 involves a hardcoded cryptographic key embedded identically across all Airwall installations, allowing anyone who discovers the key to decrypt sensitive configuration and database data across every deployment. CVE-2026-34492 is a path traversal/arbitrary file read issue where unsanitized user input passed to filesystem functions could allow attackers to retrieve arbitrary files, including credential stores and private keys.
Airwall is deployed worldwide across critical manufacturing, commercial facilities, government facilities, transportation, and energy sectors. CISA notes no known public exploitation of these flaws and states they are not remotely exploitable and have high attack complexity, reducing near-term urgency. Johnson Controls has released version 4.1.0 to address both issues and recommends standard hardening practices including key management via KMS/HSM, input validation, and network isolation for control system devices.
These are vendor-disclosed vulnerabilities rather than actively exploited threats, with remediation available. Organizations running affected Airwall versions should prioritize patching to 4.1.0 or later and follow Johnson Controls' hardening guidance, particularly around cryptographic key management given the severity of a shared hardcoded key across all customer deployments.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-03
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs