Johnson Controls Airwall Vulnerable to Hard-Coded Key and Arbitrary File Read Flaws
CISA alerts to two critical vulnerabilities in Johnson Controls Airwall, enabling data decryption, authentication bypass, and unauthorized file access.
CISA has issued a critical advisory detailing two significant vulnerabilities affecting Johnson Controls Inc. Airwall versions prior to 4.0.4. These flaws, identified as CVE-2026-64887 and CVE-2026-34492, pose a substantial risk to critical infrastructure sectors worldwide, including manufacturing, commercial facilities, government services, transportation, and energy.
The first vulnerability, CVE-2026-64887, involves the use of a hard-coded cryptographic key within the Airwall application. This hard-coded credential is identical across all installations, meaning a single disclosure could grant any knowledgeable attacker access to all affected deployments. Once discovered, this key allows attackers to decrypt sensitive application data stored in configuration and database files, leading to further data disclosure or compromise of the application infrastructure. The CVSS v3.1 score for this vulnerability is 6.8 (MEDIUM), while the CVSS v4.0 score is 7 (HIGH).
Compounding the risk is CVE-2026-34492, an arbitrary file read vulnerability. This flaw arises when user-supplied input is directly incorporated into filesystem access functions without proper validation or sanitization. Attackers can exploit this by requesting and obtaining the contents of arbitrary files on the server, provided the application process has the necessary read permissions. This could include sensitive configuration files, source code, credential stores, and private keys. Path traversal sequences (e.g., ../) or absolute file paths can be used to achieve this, and encoding variations may bypass basic filters.
Successful exploitation of either vulnerability could allow an attacker to decrypt sensitive data, bypass authentication controls, gain unauthorized access to read arbitrary files on the system, or obtain unauthorized access to protected system resources. The widespread deployment of Johnson Controls Airwall across critical infrastructure sectors and globally amplifies the potential impact of these vulnerabilities.
Johnson Controls recommends applying patches to v4.1.0 or later for all Airwall devices to remediate these issues. Additionally, the vendor provides several mitigation strategies to reduce the risk of exploitation. These include storing cryptographic keys in secure key management systems, implementing regular key rotation policies, and using unique cryptographic keys per device or deployment instance.
Further mitigation advice for CVE-2026-64887 emphasizes removing hard-coded keys from source code and binaries, replacing them with references to secure external key stores. It also suggests applying the principle of least privilege to key access, using static analysis and secrets-scanning tools in CI/CD pipelines, encrypting keys at rest and in transit, and auditing access to cryptographic keys.
For CVE-2026-34492, Johnson Controls advises validating and sanitizing all user-supplied input before file system operations, implementing strict allowlists for permitted file paths, and using canonicalization to resolve path traversal sequences before validation. Applying the principle of least privilege to file system access permissions, deploying sandboxing or chroot jails, and avoiding passing user-controlled data directly to file system APIs are also recommended.
Users are directed to consult the Johnson Controls Product Security Advisory JCI-PSA-2026-25 for more detailed mitigation instructions and to refer to the JCI universal hardening guide for comprehensive security best practices. The advisory highlights the importance of proactive security measures in protecting industrial control systems from sophisticated cyber threats.