Sensitive Data Exposure Vulnerability in Johnson Controls XAAP Application on Android
CVE-2026-34490

4.8MEDIUM

Key Information:

Vendor: Johnson Controls
Status: Xaap Application
Vendor: CVE Published:; 31 July 2026

🔔 Create Johnson Controls Vulnerability Alert

What is CVE-2026-34490?

The Johnson Controls XAAP Application for Android is susceptible to a vulnerability that allows cleartext storage of sensitive information. Attackers utilizing jailbroken or otherwise compromised devices could potentially retrieve sensitive data, posing significant risks to user privacy and security. It is critical that users upgrade to the latest version to mitigate this exposure.

Affected Version(s)

XAAP Application Android 0 < 1.53

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Local

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 31, 2026
Vulnerability Reserved
Mar 30, 2026

CVE-2026-34490 Data

JSON