CISA 2026-08-20

Johnson Controls Simplex Incident Manager

CVE-2026-27875

Machine-generated analysis · WAYSCloud LLM

Simplex Incident Manager versions up to V2.01 store user credentials in cleartext memory.

Context

The advisory identifies Johnson Controls Simplex Incident Manager <= V2.01 as the affected product. It states that the application keeps passwords and authentication tokens unencrypted in system memory, allowing a local low-privilege attacker to extract them. Johnson Controls has released a patched version (v2.01.01) and recommends upgrading to v1.01.05 or later.

Operator considerations

Check: verify the installed Simplex Incident Manager version on each system.
Isolate: limit local access to systems running the application to authorized personnel only.
Patch: upgrade to version v2.01.01 or any later release.
Log: monitor for use of memory-dumping tools or suspicious processes on the host.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system memory, potentially leading to unauthorized access to the application and connected systems.

The following versions of Johnson Controls Simplex Incident Manager are affected:

Simplex Incident Manager

Read the full advisory on CISA →