CVE-2026-64896CWE-284CWE-732broken-access-control

CVE-2026-64896

published August 27, 2026

CVSS
5.2
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects T2000: before 31.6.

The record
Technical detail
CVSS
5.2 · NONE
CVSS v4.0
5.2 · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
0.00195 · 8.7th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-08-27T21:19Z
References (1)
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories · [email protected]
EPSS history
Timeline
  • 27 AUG 14:42Z
    T2000 open debug port
    cvelistv5