VulnerabilityAwaiting Analysis

CVE-2026-64896

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.

MEDIUM 5.2EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6.

CVSS 4.0: 5.2 MEDIUMCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.15% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-284, CWE-732
Source: productsecurity@jci.com

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.