One Key, Every Airwall: Hardcoded Secret Defeats Authentication Across All Installations

CISA has published an ICS advisory, ICSA-26-225-03, covering two vulnerabilities in Johnson Controls Airwall at version 4.0.4 and below ^[1][2]. One of them is a hardcoded cryptographic key that, according to the advisory, is identical across all installations of the product and across all customer organizations, so a single public disclosure of that key grants any knowledgeable attacker access to all affected deployments ^[5].

That is the part worth sitting with. CVE-2026-64887 is classified as CWE-321, use of a hard-coded cryptographic key ^[8], and the advisory says a hardcoded credential produces a significant authentication failure that administrators find difficult to detect and difficult to remediate without manually modifying or patching the software ^[4][6]. An attacker with access to application code or binary files can use the key to decrypt sensitive application data held in configuration and database files, which the advisory says enables further data disclosure or compromise of application infrastructure ^[7]. Overall, CISA states the flaws could allow an attacker to decrypt sensitive data, bypass authentication controls, read arbitrary files, or reach protected system resources ^[3].

The second issue removes the need for code access. CVE-2026-34492 is an arbitrary file read: user-supplied input is passed into filesystem access functions without adequate validation, letting an attacker retrieve arbitrary files including configuration files, source code, credential stores and private keys, wherever the application process has read permission ^[9]. The advisory notes the usual delivery mechanisms, path traversal sequences such as ../, absolute paths such as /etc/passwd, and encoded variants such as %2e%2e%2f that defeat naive filters ^[10]. Read the two together and the chain is short: one bug supplies the ciphertext, the other supplies a key that is the same everywhere ^[15].

Johnson Controls recommends applying v4.1.0 or later patches to all Airwalls ^[11]. The residual problem with a shared secret is that a version bump is not a revocation. CISA's mitigation list for the key flaw reads as engineering guidance: store keys in a KMS or HSM rather than in source code or configuration, rotate keys on a schedule, use unique keys per device or installation, strip hardcoded keys from repositories and binaries, apply least privilege to key access, run secrets scanning in CI/CD, encrypt keys at rest and in transit, and log key retrieval for anomaly detection ^[12]. Most of those are actions in the vendor's build and key management practice, not switches an operator can flip on an appliance already in a rack ^[16]. Johnson Controls also points customers to its hardening guides and to product security advisory JCI-PSA-2026-25 ^[13].

Exposure is not niche. The advisory lists Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems and Energy as affected sectors, with worldwide deployment and the company headquartered in Ireland ^[14].

What to watch: whether 4.1.0 replaces the shared key with per-installation material or merely relocates it, since the former requires new keys on every device and the latter leaves the class of flaw intact; whether the arbitrary file read gets picked up in scanning traffic, which is the cheapest route to the encrypted stores ^[9][15]; and whether operators can get an answer from the vendor on how a compromised key is rotated in the field at all ^[12].