CVE-2026-64896

Awaiting Analysis Awaiting Analysis - Queue

Improper Access Control in Johnson Controls T2000

Publication date: 2026-08-27

Last updated on: 2026-09-03

Assigner: Johnson Controls

Description

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-64896

EUVD

EUVD-2026-67140

Affected Vendors & Products

Vendor	Product	Version / Range
johnson_controls	t2000	to 31.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves a debug and test interface in Johnson Controls T2000 that lacks proper access control. It allows unauthorized users to access functionality that should be restricted by Access Control Lists (ACLs). The issue affects T2000 versions before 31.6.

Detection Guidance

Detection methods are not specified in the provided CVE details. Check Johnson Controls' official security advisories for guidance on detecting this vulnerability in T2000 systems.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive features of the T2000 system. This may lead to data breaches, system manipulation, or disruption of building management operations. Physical access is not required as the vulnerability can be exploited remotely.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations by enabling unauthorized access to sensitive data or systems. Organizations using affected T2000 versions may face legal penalties, data protection violations, or loss of certification.

Mitigation Strategies

Update T2000 to version 31.6 or later to address the improper access control vulnerability. Verify the update is applied and monitor for unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-64896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70