CVE-2026-21661CWE-427

CVE-2026-21661

published May 6, 2026

CVSS
8.4
EPSS
0%
Percentile
1.1
In the wild
Unconfirmed
What it is

An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths.

This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

The record
Technical detail
CVSS
8.4 · NONE
CVSS v4.0
Not supplied
EPSS
0.00108 · 1.1th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2026-05-06T21:16Z
References (1)
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories · [email protected]
EPSS history
Timeline
  • 06 MAY 16:21Z
    AC2000 Uncontrolled Search Path Element
    cvelistv5