CVE-2026-27875: Cleartext Credential Storage in Johnson Controls Simplex Incident Manager Enables Local Credential Extraction
What It Is — The Simplex Incident Manager (versions ≤ V2.01) stores passwords and authentication tokens in cleartext within system memory. A local attacker with low privileges can dump memory and retrieve those credentials.
Exploitability — No public exploit code, but the flaw is trivial to weaponize with standard memory‑dump tools. CVSS 3.1 base score 5.8 (Medium). CISA has issued advisory ICSA‑26‑232‑01.
Affected Products — Johnson Controls Simplex Incident Manager ≤ V2.01 (building‑automation/ICS platform).
Why It Matters for Compliance & Audit Readiness
- SOC 2 Access Control criteria (CC6.1, CC6.2) require encryption of sensitive data at rest and in use; cleartext storage directly violates those controls.
- Continuous control monitoring must capture evidence that credential handling is protected; otherwise auditors will flag a material weakness.
- Enterprise buyers in critical‑infrastructure sectors increasingly demand proof of secure credential management as part of SOC 2 attestations.
Recommended Actions
- Upgrade to Simplex Incident Manager v2.01.01 or later.
- Restrict local console access to authorized personnel; enforce least‑privilege on host OS accounts.
- Deploy endpoint detection that alerts on memory‑dumping utilities or suspicious processes.
- Enable full‑disk encryption and secure boot to mitigate offline analysis.
- Capture and retain audit logs of local access attempts for SOC 2 evidence.
Source: CISA Advisory ICSA‑26‑232‑01