CVE-2026-34490: Johnsoncontrols Xaap

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.

Affected products

• Johnsoncontrols Xaap: before 1.53 (fixed in 1.53)

Published 2026-07-31. Last modified 2026-08-10.