One Hardcoded Key Opens Every Johnson Controls Airwall Deployment
A single key compromise grants attackers access to every Airwall-protected environment across critical manufacturing, energy, and government facilities; no per-deployment mitigation exists before patching to v4.1.0.
TL;DR
CISA published an advisory for Johnson Controls Airwall versions 4.0.4 and earlier, disclosing two vulnerabilities: a hardcoded cryptographic key (CVE-2026-64887) and an arbitrary file-read flaw (CVE-2026-34492). The hardcoded key is identical across all customer installations worldwide, affecting deployments in critical manufacturing, energy, transportation, and government facilities. A single key disclosure compromises every Airwall-protected environment. There is no per-deployment mitigation. Johnson Controls has released v4.1.0 to address both flaws.
The CISA advisory lands as something rarer than the routine ICS vulnerability notice: a supply-chain authentication failure built into the product's cryptographic foundation. Johnson Controls embedded a hardcoded key in Airwall, and used the same key for every customer, in every sector, in every country where Airwall is deployed.
That means the key isn't a per-device secret that can be rotated or revoked when compromised. It's a universal credential. If the key has been extracted from any single Airwall installation, whether through the accompanying arbitrary file-read vulnerability (CVE-2026-34492), a disgruntled insider, a source-code leak, or binary analysis, every Airwall deployment is exposed simultaneously. The advisory states this plainly: the hardcoded key is identical across all installations and all customer organizations, and a single disclosure "grants any knowledgeable attacker access to all affected deployments."
The affected sectors tell the story: critical manufacturing, energy, transportation systems, government services and facilities, and commercial facilities. These are the environments where Airwall is positioned as the boundary between protected operational networks and everything else. A compromised Airwall isn't a single-facility incident; it's a credential that travels.
Johnson Controls has released v4.1.0, which replaces the hardcoded key with proper key management. The advisory recommends storing keys in a hardware security module or KMS, implementing unique per-device keys, and rotating keys on a regular schedule. All are standard practices that should have been the baseline, not the patch notes.
For practitioners, the operational question is urgent and uncomfortable: has the key already been extracted? The arbitrary file-read vulnerability (CVE-2026-34492) provides a plausible extraction path, and the advisory notes that the key is embedded in application code and binaries. If an attacker has already obtained the key, patching to v4.1.0 closes the door going forward but doesn't invalidate sessions established with the old key or data already decrypted. The advisory doesn't address whether Johnson Controls has evidence of the key appearing in public repositories or being exploited in the wild.
Pattern recognition
This is Johnson Controls' fourth CISA ICS advisory in roughly nine months. Since December 2025, the company has disclosed OS command injection flaws in iSTAR door controllers (CVSS 8.7) and cleartext key transmission with weak PRNG in PowerG and IQPanel (CVSS 7.6). The Airwall advisory is different in kind: it's the first where a single compromised credential exposes every customer deployment simultaneously.
Published ·Deep Fathom