Vulnerability intelligence

CVE-2026-21661

Johnson Controls AC2000 CWE-427

An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

CVSS Score

8.4

High

EPSS — Exploit Probability

0.1%

Riskier than 1% of all CVEs · checked 2026-09-08

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories