CVE-2026-64896
Received Received - Intake

Improper Access Control in Johnson Controls T2000

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: Johnson Controls

Description
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-64896
EUVD
EUVD-2026-67140

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
johnson_controls t2000 to 31.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a debug and test interface in Johnson Controls T2000 that lacks proper access control. It allows unauthorized users to access functionality that should be restricted by Access Control Lists (ACLs). The issue affects T2000 versions before 31.6.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive features of the T2000 system. This may lead to data breaches, system manipulation, or disruption of building management operations. Physical access is not required as the vulnerability can be exploited remotely.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations by enabling unauthorized access to sensitive data or systems. Organizations using affected T2000 versions may face legal penalties, data protection violations, or loss of certification.

Mitigation Strategies

Update T2000 to version 31.6 or later to address the improper access control vulnerability. Verify the update is applied and monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart