CVE-2026-34490 Johnson Controls CVE debrief

Who should care

Android device users with XAAP Application installed, Johnson Controls customers, cybersecurity teams monitoring mobile device security, and operators of affected systems should be aware of this vulnerability and take necessary precautions to protect their systems and data. This includes verifying device inventory, applying vendor remediation when available, and implementing compensating controls for sensitive data protection.

Technical summary

The Johnson Controls XAAP Application on Android stores sensitive information in cleartext, allowing an attacker on a jailbroken or compromised device to retrieve sensitive data. This issue affects versions before 1.53. The vulnerability has a CVSS score of 4.8 and is classified as MEDIUM severity. The affected product is used on Android devices, and the vulnerability can be exploited by an attacker with access to a jailbroken or compromised device.

Defensive priority

Medium priority given the CVSS score of 4.8 and the potential for sensitive data retrieval on compromised devices.

Recommended defensive actions

• Verify device inventory for XAAP Application versions before 1.53
• Apply vendor remediation when available
• Monitor for indicators of compromise
• Implement compensating controls for sensitive data protection
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Johnson Controls XAAP Application on Android stores sensitive information in cleartext, allowing an attacker on a jailbroken or compromised device to retrieve sensitive data. Evidence is limited; verification of affected versions and vendor remediation status is needed. Johnson Controls XAAP Application before version 1.53 is reportedly affected. Further verification is required to confirm the scope of affected deployments and to assess the potential impact on managed environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.