8.4 HighCWE-427
CVE-2026-21661
AC2000 Uncontrolled Search Path Element
Johnson ControlsAC2000
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.1%probability of exploitation in the next 30 days
Higher than 1% of scored CVEs
SeverityCVSS
8.4High
Description NVD
An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.
Coverage 1 article · 1 outlet
- CISA alerts to DLL hijack flaw in Johnson Controls AC2000CISA · first in our coverage · official notice