Johnson Controls Airwall Flaws Expose Critical Infrastructure to Data Decryption and Arbitrary File Read

On August 13, 2026, CISA published advisory ICSA-26-225-03 detailing two vulnerabilities in Johnson Controls Inc. Airwall, a network security solution widely deployed in critical infrastructure sectors. The vulnerabilities—CVE-2026-64887 (use of hard-coded cryptographic key) and CVE-2026-34492 (external control of file name or path leading to arbitrary file read)—could allow an attacker with local access to decrypt sensitive data, bypass authentication, read arbitrary files, and gain unauthorized access to protected system resources.

CVE-2026-64887 involves a hardcoded cryptographic key embedded in the Airwall application. The key is identical across all installations, meaning a single disclosure could compromise every affected deployment. An attacker with access to application code or binaries could use the key to decrypt sensitive configuration and database files, potentially leading to further data disclosure or infrastructure compromise.

CVE-2026-34492 is an arbitrary file read vulnerability caused by insufficient validation of user-supplied input in filesystem access functions. Attackers could exploit path traversal sequences (e.g., ../) or absolute file paths to read sensitive files such as configuration files, source code, credential stores, and private keys, provided the application process has the necessary permissions.

The advisory notes that Airwall is deployed worldwide across critical manufacturing, commercial facilities, government services, transportation systems, and energy sectors. Johnson Controls, headquartered in Ireland, has released patches in version 4.1.0 and later. The company also provides a hardening guide and additional mitigation recommendations, including using secure key management systems, implementing key rotation, and removing hardcoded keys from source code.

As of the advisory publication, no public exploitation of these vulnerabilities has been reported. However, given the critical nature of the affected sectors and the ease of exploiting a hardcoded key, organizations are urged to prioritize patching and review their security posture.