The Cybersecurity and Infrastructure Security Agency (CISA), in conjunction with Johnson Controls, has issued industrial cybersecurity advisory ICSA-26-232-01 alerting operators to a high-severity memory management vulnerability (CVE-2026-27875) in the Simplex Incident Manager platform. The software, widely deployed across commercial campuses, data centers, airports, and healthcare facilities to oversee automated life-safety, fire alarm notification, and smoke evacuation systems, fails to zero out sensitive credentials in memory buffers.
Industrial Context: Fire Alarm & Life Safety Control Surface
The Simplex Incident Manager provides central graphical monitoring, event routing, and supervisory control for Simplex 4100ES and 4010ES fire alarm control panels. The management client operates in facilities operations centers, bridging building automation subnets with physical alarm notification appliances, sprinkler supervisory circuits, and air handler shutdown dampers.
Due to its mission-critical life-safety role, access to the engineering and administrative consoles governs life-safety annunciation policies. A compromise of operator workstations allows an adversary to suppress alert sequences, alter voice evacuation scripts, or falsify sensor status reports during physical intrusion or extortion attacks.
Vulnerability Mechanics & Cleartext Memory Exposure (CWE-316)
The vulnerability is tracked under CWE-316: Cleartext Storage of Sensitive Information in Memory. During administrative authentication and panel synchronization operations, user credentials—including local administrator passwords, LDAP service account bindings, and panel encryption keys—are retained in process heap memory without encryption or deterministic zeroization.
When unprivileged local operators, maintenance contractors, or malware processes create a standard Windows process dump (such as via Task Manager, MiniDumpWriteDump, or process debugging utilities), the credentials can be extracted in plaintext from the resulting memory artifacts.
# Simulated memory inspection string extraction
strings -a SimplexIncidentManager.dmp | grep -iE "(password|admin_pass|pword)"
# Output reveals cleartext administrative credential strings:
# JCI_Admin:FacilityOpsSecure2026!
# MasterKey:SimplexFireSafe9948Because the application runs in long-lived operational shifts without restarting, the credentials remain resident in unmanaged heap segments indefinitely, creating an extensive exploitation window for adversaries seeking to escalate from physical terminal access to supervisory engineering access.
Risk Matrix & Affected Installations
| Assessment Criteria | Vulnerability Profile |
|---|---|
| Advisory Number | ICSA-26-232-01 / JCI-PSA-2026-14 |
| CVE Identifier | CVE-2026-27875 |
| Vulnerability Class | CWE-316 (Cleartext Storage in Memory) |
| CVSS v3.1 Base Score | 7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Affected Software Versions | Simplex Incident Manager v3.02 and earlier |
| Critical Infrastructure Sectors | Commercial Facilities, Healthcare, Government Facilities, Critical Manufacturing |
Remediation Playbook for OT/ICS Engineers
Facilities directors, building automation engineers, and industrial security teams must execute the following defensive measures:
1. Upgrade to Remediation Firmware and Patches
Johnson Controls recommends deploying Simplex Incident Manager v3.03 or applying the hotfix package supplied through authorized Simplex branch distributors. The updated binary introduces secure memory handling APIs (SecureZeroMemory) and cryptographic wrapping for active session tokens.
2. Restrict Workstation Debug and Crash Dump Privileges
Apply Windows Local Security Policy adjustments to strip SeDebugPrivilege from all non-administrative operator accounts on life-safety consoles:
# Audit and restrict SeDebugPrivilege via PowerShell
Get-WindowsAccount -Name "OperatorGroup" | ForEach-Object {
Revoke-Privilege -Account $_.Name -Privilege "SeDebugPrivilege"
}3. Enforce Purdue Model Network Segmentation
Isolate Simplex Incident Manager workstations within dedicated Level 2 (Supervisory Control) building automation VLANs. Block all outbound internet access and enforce stateful inspection firewalls between building automation networks and corporate enterprise LANs.
