The short version
On August 20, 2026, CISA published ICSA-26-232-01 for Johnson Controls Simplex Incident Manager, republishing Johnson Controls Product Security Advisory JCI-PSA-2026-28. The finding, CVE-2026-27875, is that the application keeps user credentials, passwords and authentication tokens, in cleartext in system memory while it runs. Anyone with local access and a memory-dumping tool can read them.
It scores CVSS v3.1 5.8, medium. It is not remotely exploitable, it has high attack complexity, and CISA reports no known public exploitation. On a normal week that is a footnote.
Read it anyway, and read it for the vulnerability class rather than the score. Credential harvesting is never the first move in an intrusion. It is the second. The score reflects how hard it is to reach the flaw; it says nothing about what happens next when the attacker already has what they need to reach it.
What the advisory says
Straight from the advisory and the CSAF record:
- Product: Johnson Controls Simplex Incident Manager. Simplex is Johnson Controls' fire detection and life-safety brand.
- Affected versions: v2.01 and earlier.
- The flaw: CVE-2026-27875, CWE-316, Cleartext Storage of Sensitive Information in Memory. The application "stores user credentials (such as passwords and authentication tokens) in an unencrypted form within system memory while running."
- Who can exploit it: per CISA, "anyone with local access to the system, including attackers leveraging memory-dumping tools or insiders with elevated privileges."
- Severity: CVSS v3.1 base score 5.8, vector
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L. Confidentiality impact is High; integrity and availability are Low. - Exploitation status: not remotely exploitable, high attack complexity, no known public exploitation reported to CISA.
- Reported by: Johnson Controls, to CISA. This is a vendor self-disclosure, not an external research finding.
- Fixed version: v2.01.01.
- Sectors listed: Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy. Deployment worldwide.
One thing to check before you file the upgrade ticket
CISA's published mitigation text contains an internal contradiction. It states that Johnson Controls "has released a patched version (v2.01.01)", and then, in the list of defensive measures immediately below, says: "Upgrade the Simplex Incident Manager to version v1.01.05 or later."
Those cannot both be right. The affected range is v2.01 and earlier, so v1.01.05 sits inside the vulnerable range, not above it. A reader who follows the second line to the letter would install an older build and record the issue as remediated. Treat v2.01.01 as the target and confirm against JCI-PSA-2026-28 before scheduling the work.
This is worth flagging because advisory text gets copied into change tickets verbatim, and a wrong version number in a ticket survives a lot longer than a wrong version number on a web page.
Why a 5.8 is worth ten minutes
CVSS answers one question well: how hard is this to reach. It answers a different question badly: how much does it matter once reached.
The vector here says local access, low privileges already held, high attack complexity. In vulnerability-management terms that is a comfortable position. In intrusion terms it is a description of an attacker who is already on the host, which is the ordinary middle of any real incident. Nobody reaches a credential store as their opening move. They reach it after phishing an engineer, after a contractor laptop, after an unpatched edge service, and what they are looking for at that point is exactly this: a reusable secret that gets them to the next system.
That is the reason this class of finding is disproportionately useful to an attacker relative to its score. A remote code execution flaw gives you one machine. A harvested set of credentials gives you every machine that accepts them. Confidentiality impact is rated High here for good reason, even as the overall score lands at medium.
There is also the sector list to sit with. CISA associates this product with Energy, Transportation Systems, Critical Manufacturing, Government Services and Facilities, and Commercial Facilities. Life-safety and incident-management software tends to be deployed at exactly the sites where an operator has the least appetite for downtime and the least dedicated OT security staff.
The real issue: credentials that outlive the session
CWE-316 is not an exotic bug. Plenty of applications hold secrets in memory because they need them to authenticate onward, and doing better requires deliberate engineering: keep secrets in protected memory, zero the buffer immediately after use, hold a short-lived token instead of a password, never cache the password at all.
The structural problem is not that one application got this wrong. It is that the credential was long-lived, reusable, and replayable somewhere else. Strip those three properties and a memory dump returns something close to worthless.
This is the same argument that runs through most OT identity failures, and we have written it from other angles: why your OT network has no identity layer, how to manage passwords on hundreds of ICS devices, and MFA for service accounts and industrial devices. In every case the durable fix is the same: stop distributing secrets that are worth stealing.
What the recommended mitigations actually do
Johnson Controls and CISA list six measures. They are all reasonable, and it is worth being precise about what each one buys, because they are not equivalent.
| Recommended measure | What it actually prevents | Limitation |
|---|---|---|
| Upgrade to v2.01.01 | The credentials stop sitting in cleartext | Requires a change window; does nothing for credentials already harvested |
| Restrict local access to authorized personnel | Shrinks the set of accounts that can reach the memory | Does not stop an attacker who compromised an authorized account |
| Endpoint protection and monitoring for memory-dumping tools | Detects the common tooling | Detection, not prevention, and misses living-off-the-land techniques |
| Least privilege on host systems | Raises the bar to obtain the local privileges needed | The advisory notes low privileges are already sufficient |
| Full-disk encryption and secure boot | Blocks offline analysis of the machine | Irrelevant while the system is running, which is when the memory holds the secrets |
| Audit logging of local access attempts | Gives you the evidence trail afterwards | Purely retrospective |
Notice what the list has in common: every item except the upgrade is about protecting the host. None of them addresses the thing that makes the credential valuable, which is that it works somewhere else.
The measure that is missing
Add a seventh item that CISA does not list, because it is architectural rather than product-specific: make the harvested credential useless off the host.
Concretely, that means three properties:
- Scoped. The account used on that machine authenticates to that machine and nothing further. It is not a domain account with reach into the control network, and it is not shared with the historian, the HMI, or the engineering workstation.
- Brokered. Any connection from that host to another system requires a fresh session established through a gateway that performs its own identity check. Possession of a password is not sufficient to open one.
- Second-factor bound. The session requires a factor the attacker did not get from memory. A password and a token lifted out of a process do not by themselves produce an authenticated session anywhere else.
Under those three properties, the memory dump still succeeds, and it still yields cleartext credentials. It just does not go anywhere. The blast radius collapses from "every system that trusts this password" to "this host, which you already had."
That is the honest test for any compensating control on this advisory: it does not stop the extraction, it removes the payoff.
The ownership problem, again
Eight days ago CISA published ICSA-26-204-01 for Johnson Controls C-CURE 9000 and victor, a CVSS 9.6 remote code execution path in building access control and video management. Same vendor, same category of system, same underlying situation: physical security and life-safety software has become ordinary IT infrastructure that happens to control doors, cameras, and fire response.
And it tends to be owned by facilities rather than by IT or OT security. That ownership gap produces a predictable set of conditions: the host sits on a broad segment because that was the fastest way to make it work, it is patched on the vendor's cycle rather than a security cycle, its service accounts are convenient rather than scoped, and it is absent from the asset inventory that the security team actually maintains.
Two advisories in eight days for one vendor's building systems is a reasonable prompt to check whether these systems appear in your inventory at all. If you are not sure, that is the finding, and passive discovery will tell you faster than asking around will.
What to do this week
- Determine whether you run Simplex Incident Manager, and at what version. If it is not in your asset inventory, that is a second finding.
- Schedule the upgrade to v2.01.01. Use that version number, not the v1.01.05 that appears in the advisory's mitigation list.
- Enumerate what the accounts on that host can reach. This is the highest-value ten minutes in the whole exercise. If those credentials also work against a controller, a historian, or the domain, the medium-severity finding is not medium in your environment.
- Scope those accounts down to the host, and remove any shared or reused secret.
- Require a brokered, MFA-backed session for anything that connects from that host to another system.
- Restrict and log local access to the machine, per the vendor's guidance.
- Check the rest of the building-systems estate for the same pattern of shared credentials and broad reachability. The advisory is about one product; the pattern rarely is.
Where Trout Access Gate fits
Access Gate does not fix CVE-2026-27875. Nothing on the network can fix cleartext in an application's own memory, and any vendor telling you otherwise is selling something.
What it changes is what the extraction is worth. Access Gate sits in the data path in front of the systems that matter and requires an identity-bound, MFA-backed session for anything that reaches them. A credential lifted from a Windows host does not produce a session, because the session is brokered at the gateway against a separate identity, not granted on presentation of a password. Every attempt is recorded, so a replay attempt from an unexpected host is an alert rather than a silent success.
The scope is narrow and worth stating plainly: this bounds lateral movement, it does not prevent the disclosure. Apply the vendor upgrade on your normal process regardless. See OT identity and secure OT remote access for how the brokering works.
Source: CISA ICS Advisory ICSA-26-232-01, published August 20, 2026, republishing Johnson Controls Product Security Advisory JCI-PSA-2026-28. Verify affected versions and fixed versions against the vendor advisory before acting.