Medium severity · published Oct 6, 2026
CVE-2026-34498
Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection
5.1
CVSS
0.7%
EPSS
No
On KEV
Description
Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection.
This issue affects Illustra Standard - L4L China: before 6.0.0.66394.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Illustra Standard - L4L China · Johnson Controls
before 6.0.0.66394 · source: vendor
Affected product
IS
Illustra Standard - L4L China
Johnson Controls