Hard-Coded Cryptographic Key Vulnerability in Johnson Controls ADVMS Product
CVE-2026-34499

8.5HIGH

Key Information:

Vendor

Johnson Controls

Status
Advms
Vendor
CVE Published:
7 October 2026

What is CVE-2026-34499?

A hard-coded cryptographic key vulnerability in Johnson Controls' ADVMS allows unauthorized access to sensitive constants contained within an executable file. This issue affects all versions of the ADVMS prior to 3.10, posing a potential risk for data exposure and unauthorized manipulation. Organizations utilizing affected versions should seek remediation to safeguard against potential exploits.

Affected Version(s)

ADVMS 0 < 3.10

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.