CVE-2026-27875 Overview
CVE-2026-27875 is a cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting Johnson Controls Simplex Incident Manager and Autocall Fire Administrator. The flaw allows an attacker with local access and low privileges to retrieve embedded sensitive data from process memory. Johnson Controls has addressed the issue in version 2.01.05 and later.
Critical Impact
A local, low-privileged attacker can extract sensitive data stored in cleartext within the application's memory space, exposing credentials or other embedded secrets that support fire alarm and incident management systems.
Affected Products
- Johnson Controls Simplex Incident Manager versions before 2.01.05
- Johnson Controls Autocall Fire Administrator versions before 2.01.05
Discovery Timeline
- 2026-08-21 - CVE-2026-27875 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-27875
Vulnerability Analysis
The Simplex Incident Manager and Autocall Fire Administrator applications hold sensitive information in memory without encryption or protective encoding. An attacker with local access to a host running the affected software can inspect the process address space and recover embedded secrets. The condition maps to [CWE-316], which covers scenarios where confidential values persist in cleartext form during runtime.
The vulnerability carries an attack complexity marker indicating the exploit relies on specific runtime conditions to succeed. Successful exploitation compromises confidentiality of data in the affected process and can extend impact to subsequent systems that reuse the exposed credentials, given the high subsequent-system confidentiality rating in the CVSS vector.
Root Cause
The root cause is the storage of sensitive strings, such as embedded credentials or configuration secrets, as plain values in process memory. The application does not clear, encrypt, or otherwise protect these values during runtime. Any actor able to read process memory can therefore recover them intact.
Attack Vector
Exploitation requires local access to the workstation or server running Simplex Incident Manager or Autocall Fire Administrator, along with low-privileged user rights. The attacker attaches a debugger, uses a memory-dumping utility, or reads process memory through operating system APIs. No user interaction is required. Because the scope of confidentiality impact extends to subsequent components, recovered secrets can enable pivot into connected fire alarm administration infrastructure.
No public exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.065%.
Detection Methods for CVE-2026-27875
Indicators of Compromise
- Unexpected use of process memory inspection tools such as procdump, Task Manager full memory dumps, or WinDbg attaching to SimplexIncidentManager or AutocallFireAdministrator processes.
- Creation of .dmp files in user-writable directories on hosts running the affected software.
- Interactive logons by non-administrative accounts that then spawn debugger or memory-reader processes.
Detection Strategies
- Monitor for handle acquisitions to affected process IDs with PROCESS_VM_READ or PROCESS_ALL_ACCESS rights from unexpected parents.
- Alert on invocations of MiniDumpWriteDump API calls targeting the vulnerable applications.
- Correlate local logon events with subsequent process access to fire administration binaries.
Monitoring Recommendations
- Enable Windows Security auditing for object access and process creation on hosts running Simplex Incident Manager or Autocall Fire Administrator.
- Forward endpoint telemetry to a centralized analytics platform to baseline normal administrator activity and flag deviations.
- Track outbound authentication attempts using credentials that match those embedded in the fire administration stack.
How to Mitigate CVE-2026-27875
Immediate Actions Required
- Upgrade Simplex Incident Manager and Autocall Fire Administrator to version 2.01.05 or later on all affected hosts.
- Restrict interactive and remote logon rights on servers running the affected software to a minimal set of administrators.
- Rotate any credentials that may have been embedded or configured in prior versions of the applications.
Patch Information
Johnson Controls addressed the issue in Simplex Incident Manager / Autocall Fire Administrator version 2.01.05. Refer to the Johnson Controls Security Advisories portal for release artifacts and vendor guidance.
Workarounds
- Enforce least privilege on hosts running the affected software so that only vetted operators can log in locally.
- Apply application allowlisting to block debuggers and memory-dumping utilities from executing on production fire administration systems.
- Segment fire alarm management workstations from general corporate networks to reduce the blast radius of any credential exposure.
# Configuration example: verify installed version on Windows
wmic product where "Name like 'Simplex Incident Manager%'" get Name,Version
wmic product where "Name like 'Autocall Fire Administrator%'" get Name,Version
# Restrict interactive logon rights via secedit
secedit /export /cfg current.inf
# Edit SeInteractiveLogonRight to include only approved administrator groups
secedit /configure /db secedit.sdb /cfg current.inf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
