# Credentials in Plain Sight: Johnson Controls Simplex Incident Manager Exposes Auth Tokens in Memory


## The Threat


Incident management software is meant to be the nerve center during emergencies — the system you rely on when everything else is going wrong. So when that software itself becomes the vulnerability, the implications extend well beyond a routine patch cycle. That's the situation facing organizations running Johnson Controls' Simplex Incident Manager, a widely deployed platform used across critical infrastructure sectors to coordinate responses to physical security incidents.


CVE-2026-27875 describes a fundamental cryptographic failure: the application stores user passwords and authentication tokens in cleartext within system memory while it's running. Any local user with low privileges — think a maintenance contractor, a disgruntled insider, or an attacker who has already gained a foothold through an unrelated vulnerability — can use widely available memory-dumping tools to extract those credentials. From there, the path to unauthorized access across the application and any connected systems becomes straightforward.


What makes this particularly uncomfortable is the deployment context. Simplex Incident Manager doesn't sit in a typical enterprise IT environment. It runs in buildings, facilities, government complexes, transit hubs, and manufacturing plants — environments where physical security and cyber security intersect. The people running this software are managing access control, alarms, and incident response workflows. Compromising their credentials isn't just an IT problem; it's a physical security problem.


## Severity and Impact


| Field | Details |

|---|---|

| CVE | CVE-2026-27875 |

| CWE | CWE-316 — Cleartext Storage of Sensitive Information in Memory |

| CVSS v3.1 Score | 5.8 (Medium) |

| CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L |

| CVSS v4.0 Score | 5.8 (Medium) |

| CVSS v4.0 Vector | CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N |

| Attack Vector | Local |

| Attack Complexity | High |

| Privileges Required | Low |

| User Interaction | None |

| Confidentiality Impact | High |

| Integrity/Availability | Low |


The "Medium" score deserves scrutiny. The high complexity rating reflects that exploitation requires local access and specific conditions — but in OT and physical security environments, insider threat and supply chain access are among the most common attack vectors, not exotic edge cases. The Confidentiality impact is rated High for a reason: once credentials leave memory, they can authenticate to the broader system with full user authority.


## Affected Products


  • Johnson Controls Simplex Incident Manager — all versions up to and including V2.01

    • Deployed globally across:

  • Critical Manufacturing
  • Commercial Facilities
  • Government Services and Facilities
  • Transportation Systems
  • Energy

    • ## Mitigations


    Johnson Controls has released a patched version addressing CVE-2026-27875. Organizations should act on the following in priority order:


    Immediate actions:

  • Upgrade Simplex Incident Manager to v2.01.01 or later (or v1.01.05 for older branches)
  • Restrict local system access to authorized personnel only — enforce this at the OS and physical level

    • Defensive hardening:

  • Deploy endpoint protection capable of detecting memory-dumping tools (e.g., tools leveraging Windows MiniDumpWriteDump or Linux /proc/mem access)
  • Enable full-disk encryption and secure boot on all hosts running the Simplex platform to reduce offline memory analysis risk
  • Apply the principle of least privilege — no user or service account should hold more access than required
  • Enable audit logging and monitor for unauthorized local login attempts and suspicious process execution

    • Detection:

  • Alert on known memory-scraping tool signatures (ProcDump, Mimikatz derivatives, or custom /proc-based tools on Linux hosts)
  • Review access logs for credential use from unexpected source locations following any suspected local compromise

    • Full remediation guidance is available in Johnson Controls Product Security Advisory JCI-PSA-2026-28 at the Johnson Controls Trust Center.


    ## References


  • [Johnson Controls Trust Center — Security Advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
  • [CISA ICS Advisory](https://www.cisa.gov/ics)
  • [CISA Recommended Practices — ICS-TIP-12-146-01B](https://www.cisa.gov/ics)
  • [CISA Notification and Privacy Policy](https://www.cisa.gov/notification)

    • ---


    ## HackWire Analysis


    A CVSS 5.8 on a credential exposure bug will put this in the "schedule it next quarter" pile for a lot of security teams. That would be a mistake.


    The medium severity rating is mechanically correct — local access, high complexity — but it misreads the threat model for operational technology environments. In critical facilities, local access is the norm, not the exception. Third-party vendors, integrators, building engineers, and HVAC technicians routinely sit at or near systems like Simplex Incident Manager. The attacker profile here isn't a remote APT group; it's someone who already has a badge and a laptop, or an attacker who pivoted from an IT network into the OT zone — a path that's been well-documented in incidents at utilities and manufacturing plants for years.


    The credential exposure itself compounds the risk further than the advisory makes explicit. Simplex Incident Manager doesn't operate in isolation. It connects to access control systems, alarm panels, video management platforms, and potentially fire safety infrastructure. An authentication token extracted from memory doesn't just open a software account — it may open doors, disable alarms, or suppress incident alerts. That's a different risk tier than a typical enterprise credential leak.


    CWE-316 — cleartext credentials in memory — is also frustratingly common in the OT and building automation space. Vendors in this segment have historically prioritized uptime and backward compatibility over cryptographic hygiene, and that technical debt is now surfacing as a recurring pattern in CISA advisories. Until the industry normalizes secure credential handling as a baseline requirement (not a premium feature), these disclosures will keep coming.


    Security teams in critical facilities should treat this patch with the same urgency as a remotely exploitable flaw — because the threat actors who care about these systems are already inside the perimeter.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)