CVE-2026-27875: Johnson Controls Simplex Incident Manager / Autocall Fire Administrator

Medium severity, CVSS 6.9. EPSS: 0.1% chance of exploitation in the next 30 days.

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05.

Affected products

• Johnson Controls Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05 (fixed in 2.01.05)

Published 2026-08-21. Last modified 2026-09-03.