Johnson Controls Simplex Incident Manager Credential Exposure: A Local-Access Flaw with Critical Infrastructure Reach

As reported by CISA in ICS advisory ICSA-26-232-01, Johnson Controls has disclosed a cleartext credential storage vulnerability (CVE-2026-27875) in its Simplex Incident Manager product, affecting versions up to and including V2.01. The flaw — classified under CWE-316 — leaves user passwords and authentication tokens unencrypted in system memory during runtime, creating an extraction opportunity for any local attacker or insider with access to the host system.

Vulnerability at a Glance

Why the CVSS Score Undersells the Risk

The Medium severity rating (5.8) might lull resource-constrained OT teams into deprioritizing this patch. That would be a mistake. The attack vector is local and the attack complexity is high, which caps the CVSS number — but the impact on confidentiality is rated High. In an incident management platform deployed across critical manufacturing, government facilities, energy, and transportation environments, stolen credentials don't just unlock one application. They can become a pivot point into broader building automation and safety systems that are often less segmented than IT environments.

The real threat model here isn't a remote zero-day — it's the insider, the compromised contractor laptop, or the lateral movement from an adjacent compromised host that turns a Medium CVE into a critical infrastructure incident.

Beyond the Advisory: What Defenders Should Be Thinking About

The advisory notes a patch is available, but we flag a discrepancy worth verifying directly with Johnson Controls: the remediation text references upgrading to both "v2.01.01" and "v1.01.05 or later" — an inconsistency that suggests a possible copy-paste error in the advisory. Organizations should confirm the correct target version with Johnson Controls support before proceeding.

Broader Implications for Building Automation Security

Shield53 Recommendations

Immediate Actions

• Patch now. Upgrade to the patched release (v2.01.01) after confirming the correct version with Johnson Controls via advisory JCI-PSA-2026-28.
• Audit local access. Inventory every account with local login rights to Simplex Incident Manager hosts. Remove unnecessary accounts and enforce least privilege immediately.
• Deploy EDR or application allowlisting. Detect and block common memory-dumping tools (e.g., procdump, Mimikatz, custom .NET memory readers). Windows Defender Application Control or AppLocker can restrict unsigned executables on these hosts.
• Enable full-disk encryption and Secure Boot on all Simplex Incident Manager workstations to reduce offline memory capture via tools that read from hibernation files or crash dumps.
• Force credential rotation. After patching, rotate all credentials that were used on affected hosts, including any shared service accounts or AD-integrated logins.

Longer-Term Hardening

• Implement network segmentation between Simplex Incident Manager hosts and general corporate networks using VLAN isolation or firewall rules.
• Deploy centralized Windows Event Forwarding (WEF) and monitor for suspicious process creation events targeting LSASS or application memory spaces.
• Review vendor security practices for all building automation and physical security information management (PSIM) platforms — not just Johnson Controls — for similar cleartext memory storage patterns.

While this vulnerability may not be making headlines, it represents a class of weakness that persists across the OT and building automation landscape. The organizations that treat it as a wake-up call to audit their entire facilities security stack — rather than a single patch to check off — will be meaningfully more resilient when the next disclosure arrives.