Description
An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths.
This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Johnson Controls | AC2000 | 10.6 – < release 10, 11.0 – < release 9, 12 – < release 3 | release 10 |
Advisories 1
- ICSA-26-125-05 Johnson Controls CEM AC2000 CISA ICS & IT advisories · May 5, 2026