Source context: this article examines information published by the source on August 20, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What the vulnerability is
Johnson Controls has identified a security flaw (CVE-2026-27875) in the Simplex Incident Manager application. The software stores sensitive information, including user passwords and authentication tokens, in an unencrypted form within the system memory while the application is running. This cleartext storage (CWE-316) could allow a local attacker with low privileges to extract these credentials using memory-dumping tools or through insider access with elevated privileges.
Exposure and applicability
This vulnerability affects Johnson Controls Simplex Incident Manager versions up to and including V2.01. The risk is specific to environments where the application is deployed as part of building automation systems in sectors such as energy, critical manufacturing, transportation, and government facilities.
It is important to note that this vulnerability is not remotely exploitable; it requires local access to the host system running the software.
Remediation priorities
Our analysis suggests a tiered approach to reducing risk based on the vendor’s guidance:
Primary Update Path
The manufacturer has released a patched version, v2.01.01, to address this issue. Asset owners should prioritize upgrading to this version. Note that there is a discrepancy in the source documentation which also mentions version v1.01.05 as a mitigation; operators should verify with the OEM which specific version path is appropriate for their current installation.
Compensating Controls
For environments where immediate patching is not feasible, we recommend focusing on reducing the likelihood of local access:
* Access Restriction: Limit physical and logical local access to the host systems to authorized personnel only.
* Privilege Management: Enforce the principle of least privilege on the host operating system to limit the ability of low-privileged users to execute memory-dumping tools.
* Host Hardening: Implement full-disk encryption and secure boot to reduce the risk of offline analysis, and deploy endpoint protection to detect suspicious processes or known memory-extraction tools.
How to validate remediation
To verify that the exposure has been reduced, administrators should:
1. Confirm the installed version of Simplex Incident Manager matches the patched release (v2.01.01) via the application’s about menu or system registry.
2. Audit local user accounts on the host machine to ensure no unnecessary low-privileged accounts have access to the system.
3. Review endpoint protection logs for any unauthorized attempts to utilize memory-dumping utilities.
Limits and open questions
A version check alone does not guarantee total security, as it only addresses this specific vulnerability and not other potential vectors. Because the vulnerability requires local access, the actual risk depends heavily on the physical and logical security of the server hosting the application. There remains a conflict in the provided documentation regarding whether v1.01.05 or v2.01.01 is the definitive patched version; this should be clarified with Johnson Controls before deployment.
Source and editorial note
Johnson Controls Simplex Incident Manager · Source date: August 20, 2026 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗