6 minmedium
Johnson Controls Simplex Incident Manager (CVE-2026-27875)
Johnson Controls Simplex Incident Manager versions V2.01 and earlier are vulnerable to cleartext storage of sensitive information in memory (CVE-2026-27875). A local attacker with low privileges can extract user credentials and authentication tokens from system memory using memory-dumping tools, potentially leading to unauthorized access to the application and connected systems.
Conf:highAnalyzed:2026-08-20openrouter
Showing defanged values
- cveCVE-2026-27875Cleartext storage of sensitive information in memory allows a local attacker with low privileges to extract user credentials and authentication tokens.
Detection / Hunteropenrouter
What Happened
A security flaw was found in Johnson Controls Simplex Incident Manager software, which is used in critical infrastructure like manufacturing and transportation. The software keeps user passwords and login tokens in an unencrypted format in the computer's memory while it runs. Someone with local access to the computer, such as an insider or an attacker who has gained some access, could use specialized tools to read this memory and steal the passwords. This could allow them to log in without permission and access connected systems. Organizations using this software should update to the latest version and restrict who can physically or locally access the computers running it.
Key Takeaways
- Johnson Controls Simplex Incident Manager versions V2.01 and earlier store user credentials and authentication tokens in cleartext in system memory.
- A local attacker with low privileges can extract these credentials using memory-dumping tools, leading to unauthorized application access.
- The vulnerability (CVE-2026-27875) has a CVSS v3.1 base score of 5.8 (Medium) and requires local access with high attack complexity.
- Johnson Controls released a patched version (v2.01.01) and recommends restricting local access, implementing endpoint monitoring, and enforcing least privilege.
Affected Systems
- Johnson Controls Simplex Incident Manager <=V2.01
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-27875 | Johnson Controls Simplex Incident Manager | Medium | Cleartext storage of sensitive information in memory allows a local attacker with low privileges to extract user credentials and authentication tokens. |
Attack Chain
- Initial Access: Attacker gains local access to the host system with low privileges.
- Credential Access: Attacker uses memory-dumping tools to extract cleartext credentials and authentication tokens from the Simplex Incident Manager process memory.
- Defense Evasion: The high attack complexity requirement suggests the attacker may need to evade endpoint protection to dump memory.
- Lateral Movement: Extracted credentials are used to gain unauthorized access to the Simplex Incident Manager application and connected systems.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules but recommends implementing endpoint protection and monitoring to detect memory-dumping tools or suspicious processes.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR solutions can detect memory-dumping tools and suspicious process behavior, but the specific extraction of cleartext from a legitimate application's memory space may be difficult to distinguish from normal administrative activity without specific memory access alerts. |
| Network Visibility | Low | The vulnerability is exploited locally and does not involve network traffic during the credential extraction phase. Network monitoring may only detect subsequent unauthorized access using the stolen credentials. |
| Detection Difficulty | Hard | Detecting memory access by unauthorized processes requires specific EDR capabilities and tuning. The high attack complexity and local access requirement mean the attacker may already have some foothold, making it harder to distinguish malicious memory access from legitimate administrative tools. |
Required Log Sources
- Endpoint Process Creation Logs
- EDR Memory Access Alerts
- Windows Event Logs (Process Access)
- Application Authentication Logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for processes attempting to read or write the memory space of the Simplex Incident Manager application, which may indicate credential extraction attempts. | EDR process access events, Windows Event Log (Event ID 4663 for object access or Sysmon Event ID 10 for ProcessAccess) | Credential Access | Medium - Legitimate administrative or debugging tools may also access application memory, requiring baseline analysis to identify anomalies. |
| Hunt for the execution of known memory-dumping tools on systems hosting Simplex Incident Manager. | EDR process execution logs, Sysmon Event ID 1 (ProcessCreate) | Credential Access | Low - Memory-dumping tools are uncommon in typical ICS environments, though administrators may use them for troubleshooting. |
Control Gaps
- Standard network-based IDS/IPS will not detect local memory extraction.
- Application-level access controls do not prevent local memory access by low-privileged users.
Key Behavioral Indicators
- Process access events targeting the Simplex Incident Manager executable by non-system processes.
- Execution of memory-dumping utilities (e.g., procdump, WinDbg) on hosts running Simplex Incident Manager.
- Unusual authentication attempts to the Simplex Incident Manager application following local memory access activity.
False Positive Assessment
Medium - Legitimate administrative or debugging tools may access application memory, requiring baseline analysis to distinguish from malicious activity.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider upgrading Johnson Controls Simplex Incident Manager to version v2.01.01 or later.
- If patching is delayed, evaluate whether restricting local access to systems running the Simplex Incident Manager to authorized personnel only is feasible.
- If your EDR supports process access monitoring, consider enabling alerts for unauthorized processes accessing the Simplex Incident Manager application memory.
Infrastructure Hardening
- Consider implementing endpoint protection and monitoring to detect memory-dumping tools or suspicious processes on affected hosts.
- Evaluate the feasibility of enforcing full-disk encryption and secure boot on systems running Simplex Incident Manager to reduce the risk of offline memory analysis.
- Review and strengthen access control policies to enforce the principle of least privilege on host systems.
User Protection
- Consider monitoring for unauthorized local access attempts and implementing audit logging on affected systems.
- If applicable, evaluate whether multi-factor authentication can be enforced for access to the Simplex Incident Manager application to mitigate the impact of credential theft.
Security Awareness
- Consider reinforcing training for personnel with local access to ICS/OT systems on the risks of memory-dumping tools and unauthorized credential access.
- Where applicable, remind staff to report any unexpected presence of debugging or diagnostic tools on production ICS systems.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping3 techniques
Tactic
Initial Access
Tactic
