Johnson Controls Inc. Airwall Vulnerabilities Exposed

Vulnerability Overview

The Johnson Controls Inc. Airwall product has been found to contain two critical vulnerabilities that could allow attackers to decrypt sensitive data, bypass authentication controls, and gain unauthorized access to system resources. The affected versions are Airwall <=4.0.4, and the company recommends applying v4.1.0 or later patches to mitigate the risks.

CVE-2026-64887: Hardcoded Password or Cryptographic Key

A hardcoded password or cryptographic key was identified in the Airwall application. This vulnerability allows an attacker to decrypt sensitive application data stored in configuration and database files, enabling further data disclosure or compromise of application infrastructure. The hardcoded key is identical across all installations of the product and across all customer organizations, making it a significant authentication failure that can be difficult for system or application administrators to detect.

CVE-2026-34492: Arbitrary File Read Vulnerability

An arbitrary file read vulnerability was identified in the Airwall application. This issue occurs when user-supplied input is directly incorporated into filesystem access functions without adequate validation or sanitization. As a result, an attacker can request and obtain the contents of arbitrary files on the server, including sensitive configuration files, source code, credential stores, and private keys, provided the application process has permission to read them.

Remediations and Mitigations

To help reduce risk of exploitation, Johnson Controls recommends the following defensive measures:

• Apply v4.1.0 or later patches for all Airwalls.
• Store all cryptographic keys in a secure key management system (KMS) or hardware security module (HSM) rather than embedding them in source code or configuration files.
• Implement a regular key rotation policy to limit the exposure window if a key is compromised.
• Use unique cryptographic keys per device, installation, or deployment instance to prevent a single compromised key from affecting all installations.
• Remove any hard-coded keys from source code repositories and binaries, replacing them with references to secure external key stores.
• Apply the principle of least privilege to key access, ensuring only authorized processes and personnel can retrieve cryptographic material.
• Use static analysis and secrets-scanning tools in CI/CD pipelines to detect and prevent hard-coded keys from being committed to source control.
• Encrypt keys at rest and in transit and ensure key-wrapping mechanisms are in place for any keys stored on disk.
• Audit and monitor access to cryptographic keys, logging all retrieval and usage events for anomaly detection.

Conclusion

The vulnerabilities in Johnson Controls Inc.'s Airwall product highlight the importance of applying the latest patches to prevent exploitation and ensure the security of critical infrastructure. Organizations that rely on the system for sensitive data and system resources should take immediate action to apply the recommended patches and implement the defensive measures outlined above.