Credential Exposure in Johnson Controls Simplex Incident Manager

Source context: this article examines information published by the source on August 20, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

Johnson Controls has identified a vulnerability (CVE-2026-27875) in the Simplex Incident Manager application. The software stores sensitive information, including user passwords and authentication tokens, in unencrypted form within system memory during operation. This flaw (CWE-316) could allow an attacker with local access and low privileges to use memory-dumping tools to extract these credentials.

Exposure and applicability

This vulnerability affects Simplex Incident Manager versions V2.01 and earlier. While the vulnerability is not exploitable remotely, it is relevant to healthcare providers and clinics that utilize this system for building automation and incident response within their commercial facilities.

In a healthcare environment, the compromise of facility management systems can impact operational resilience. Furthermore, if an attacker extracts credentials from this application, they may attempt to use those credentials to gain unauthorized access to connected systems, which could potentially include networks housing electronic Protected Health Information (ePHI).

Remediation priorities

Our analysis suggests the following prioritized actions for healthcare IT and clinical engineering teams:

1. Software Update: The primary remediation is upgrading to the patched version v2.01.01. Note that while some documentation mentions v1.01.05, v2.01.01 is listed as the patched version for this vulnerability.
2. Local Access Restriction: Limit physical and logical local access to systems running the Simplex Incident Manager to authorized personnel only. This serves as a primary control to prevent the initial local access required for exploitation.
3. Endpoint Hardening: Implement endpoint protection and monitoring designed to detect the use of memory-dumping tools or suspicious processes. This is a detective control intended to limit damage by alerting security teams to an active attempt at credential extraction.
4. Privilege Management: Enforce the principle of least privilege on host systems to reduce the number of users with the permissions necessary to perform memory dumps.

How to validate remediation

To verify that exposure has been reduced, administrators should:
* Confirm the installed version of Simplex Incident Manager matches the patched release (v2.01.01).
* Review local access logs and system permissions to ensure only essential personnel have local login capabilities.
* Verify with security operations that endpoint monitoring is active on the host systems and capable of flagging unauthorized memory access tools.

Limits and open questions

Updating the software could reduce the likelihood of credential extraction from memory, but it does not guarantee total immunity from other attack vectors. There is a discrepancy in the source material regarding whether version v1.01.05 or v2.01.01 is the correct upgrade path; administrators should verify the appropriate version for their specific deployment with the vendor.

Additionally, while this vulnerability requires local access, it does not account for scenarios where an attacker has already gained a foothold on the network and moved laterally to the host system. Residual risk remains if the underlying host operating system is compromised via other means.

Source and editorial note

Johnson Controls Simplex Incident Manager · Source date: August 20, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment