Johnson Controls Simplex Incident Manager Leaks Credentials
Simplex Incident Manager stores credentials in cleartext memory, letting a local attacker extract passwords and tokens; patch v2.01.01 fixes it.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory for Johnson Controls Simplex Incident Manager, an incident management application used across critical manufacturing, commercial facilities, government facilities, transportation, and energy sectors worldwide. The flaw, tracked as CVE-2026-27875 (CWE-316: Cleartext Storage of Sensitive Information in Memory), causes the application to store user credentials such as passwords and authentication tokens unencrypted in system memory while running. A local attacker with low privileges, or an insider, could use memory-dumping tools to extract these credentials and potentially pivot to unauthorized access of the application and connected systems.
Exploitation requires local access and has high attack complexity; CISA notes no known public exploitation has been reported. Johnson Controls has released version v2.01.01 to remediate the issue and recommends upgrading, restricting local access to authorized personnel, deploying endpoint monitoring for memory-dumping tools, enforcing least-privilege access controls, and using full-disk encryption and secure boot to limit offline memory analysis risk. Organizations should also implement audit logging and monitor for unauthorized local access attempts.
Given the local-access requirement, high attack complexity, and absence of known in-the-wild exploitation, this represents a moderate risk best addressed through prompt patching and standard endpoint hardening rather than emergency response.
Mentioned in this report
Detection guidance
Process Memory Access to Simplex Incident Manager Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects processes opening a handle to a Simplex Incident Manager process with memory-read access rights, consistent with credential-dumping tools exploiting CVE-2026-27875's cleartext-credentials-in-memory weakness. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Memory Access to Simplex Incident Manager Process
description: Detects a process requesting VM_READ/memory-dump-capable access to a
Johnson Controls Simplex Incident Manager process, which may indicate an attacker
or insider extracting cleartext credentials stored in memory (CVE-2026-27875).
tags:
- attack.credential-access
- attack.t1003
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|contains: Simplex
GrantedAccess|contains:
- '0x1F'
- '0x1FFFFF'
- '0x1010'
- '0x1410'
- '0x143A'
filter_self:
SourceImage|endswith: TargetImage
filter_known_edr:
SourceImage|endswith:
- \MsMpEng.exe
- \SenseIR.exe
- \CSFalconService.exe
condition: selection and not (filter_self or filter_known_edr)
falsepositives:
- Endpoint security/AV agents performing legitimate memory scans
- Application crash/watchdog processes that attach to the Incident Manager process
for health checks
level: medium
id: d87ee21f-89d9-5b69-927d-944e5e23408a
status: experimental
author: Vorant
Rundll32 Comsvcs MiniDump Targeting Incident Manager Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the classic rundll32.exe comsvcs.dll,MiniDump technique used to dump process memory, applicable to dumping credentials from a running Simplex Incident Manager process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rundll32 Comsvcs MiniDump Targeting Incident Manager Process
description: Detects use of rundll32.exe with comsvcs.dll MiniDump export, a living-off-the-land
technique to dump a running process's memory (e.g. Simplex Incident Manager) to
disk for offline credential extraction.
tags:
- attack.credential-access
- attack.t1003
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \rundll32.exe
CommandLine|contains|all:
- comsvcs.dll
- MiniDump
condition: selection
falsepositives:
- Rare legitimate administrative use of comsvcs MiniDump for crash diagnostics by
support staff
level: high
id: 9b38c4f9-b8a6-59d4-bd1b-b93062a3650b
status: experimental
author: Vorant
Memory Dump File Written for Incident Manager Related Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a .dmp file whose name references the Simplex/Incident Manager process, indicating a memory-dumping tool has written process memory to disk where cleartext credentials could be recovered. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Memory Dump File Written for Incident Manager Related Process
description: Detects a dump file being written to disk that references the Simplex
Incident Manager process name, consistent with a memory-dumping tool exfiltrating
process memory containing cleartext credentials (CVE-2026-27875).
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: .dmp
TargetFilename|contains: Simplex
filter_vendor_logs:
TargetFilename|contains:
- \ProgramData\JohnsonControls\
- \Logs\Diagnostics\
condition: selection and not filter_vendor_logs
falsepositives:
- Vendor-provided diagnostic or crash-reporting tools that write legitimate .dmp files
to a known logging directory
level: medium
id: 7f3466e0-2843-5dc5-9f1a-257553c33928
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-232-01
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs