CVE-2026-34490: Johnson Controls XAAP Info Disclosure Flaw

CVE-2026-34490 Overview

CVE-2026-34490 is a cleartext storage of sensitive information vulnerability [CWE-312] in the Johnson Controls XAAP Application for Android. The application stores sensitive data on the device without encryption. An attacker with access to a jailbroken, rooted, or otherwise compromised device can retrieve this data from local storage. The issue affects all versions of the XAAP Application prior to 1.53.

Critical Impact
Local attackers with elevated device access can recover sensitive information stored in cleartext by the XAAP mobile client, leading to confidentiality loss.

Affected Products

Johnson Controls XAAP Application for Android, versions prior to 1.53
Devices that are rooted, jailbroken, or otherwise compromised are the primary exposure surface
Fixed in XAAP Application version 1.53 and later

Discovery Timeline

2026-07-31 - CVE-2026-34490 published to the National Vulnerability Database (NVD)
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-34490

Vulnerability Analysis

The XAAP Android application writes sensitive information to local device storage without applying encryption or platform-provided secure storage mechanisms. On Android, sensitive material should be protected using the Android Keystore system or EncryptedSharedPreferences. When applications persist data in cleartext, any actor with read access to the app's data directory can recover the content.

The vulnerability is categorized as Insecure Data Storage, a class of mobile app weakness tracked under CWE-312: Cleartext Storage of Sensitive Information. Exploitation requires local access to the device file system, typically through root, jailbreak, or malware with elevated privileges. Attack complexity is low once such access is achieved.

Root Cause

The root cause is the absence of encryption for sensitive artifacts written to the application's private storage. Android's sandbox normally isolates app data from other applications, but this control is bypassed on rooted devices, through Android Debug Bridge (ADB) backup, or via forensic tooling. Relying solely on operating system sandboxing, without an additional cryptographic layer, exposes the data whenever the sandbox boundary is broken.

Attack Vector

An attacker requires local access to a compromised Android device running a vulnerable XAAP version. After gaining root or equivalent file-system read privileges, the attacker enumerates the application's data directory under /data/data/<xaap.package>/ and reads configuration files, shared preferences, databases, or cache artifacts containing the cleartext material. No network access or user interaction is required. See the Johnson Controls Security Advisory for vendor-provided details.

Detection Methods for CVE-2026-34490

Indicators of Compromise

Presence of root management binaries such as su, magisk, or busybox on managed Android endpoints running XAAP
Unexpected ADB connections or adb backup operations targeting the XAAP package
File-system access events reading from the XAAP app's private data directory by non-XAAP processes

Detection Strategies

Inventory installed XAAP Android versions across the mobile fleet and flag any build below 1.53
Use mobile threat defense or Mobile Device Management (MDM) posture checks to identify rooted or jailbroken devices with XAAP installed
Review MDM compliance logs for devices reporting integrity attestation failures such as Google Play Integrity or SafetyNet failures

Monitoring Recommendations

Continuously monitor device integrity signals and block XAAP usage on non-compliant devices
Alert on installation of side-loaded applications or elevation utilities on devices provisioned with XAAP
Correlate mobile telemetry with identity and access logs to spot credential reuse originating from suspect devices

How to Mitigate CVE-2026-34490

Immediate Actions Required

Upgrade the Johnson Controls XAAP Android Application to version 1.53 or later on all managed devices
Enforce MDM policies that prohibit XAAP execution on rooted, jailbroken, or otherwise compromised devices
Rotate any credentials, tokens, or secrets that may have been stored by vulnerable XAAP installations

Patch Information

Johnson Controls addressed the issue in XAAP Application version 1.53. Refer to the Johnson Controls Security Advisory for the official fixed build and deployment guidance.

Workarounds

Restrict XAAP deployment to corporate-managed Android devices enrolled in MDM with integrity attestation enabled
Disable ADB, USB debugging, and third-party app installation on devices running XAAP
Apply application-level containerization or work-profile isolation to reduce cleartext exposure on shared devices

bash

# Example MDM compliance check: flag devices where XAAP is present and integrity is not verified
# Pseudocode for an MDM policy rule
if app.package == "com.johnsoncontrols.xaap" \
   and (device.rooted == true or device.play_integrity == "FAIL"):
    action: block_app_launch
    notify: security_operations