Johnson Controls Simplex Incident Manager

Executive Summary

The CISA advisory reports a vulnerability (CVE‑2026‑27875) in Johnson Controls Simplex Incident Manager ≤ V2.01 that stores credentials in cleartext memory, enabling low‑privilege local attackers to extract them. Critical Manufacturing, Commercial Facilities, Government Services, Transportation and Energy sectors worldwide are exposed, with a CVSS 5.8 rating indicating moderate‑to‑high exploitability. Immediate decisions are required on patch deployment, network segmentation of affected hosts, and activation of incident response procedures.

Verified Facts

• Simplex Incident Manager ≤ V2.01 stores user credentials in unencrypted form in system memory — CISA Advisory.
• A local attacker with low privileges can dump memory to obtain passwords and authentication tokens — CISA Advisory.
• The vulnerability is identified as CVE‑2026‑27875 with a CVSS v3 base score of 5.8 — CISA Advisory.
• Affected sectors include Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, and Energy — CISA Advisory.
• Johnson Controls has released a patched version of Simplex Incident Manager — CISA Advisory.

Threat Classification

Credential Access – exploitation of cleartext credential storage in memory (CWE‑312) affecting OT/ICS management software; sectors: Critical Manufacturing, Commercial Facilities, Government Services, Transportation, Energy; geographic scope: worldwide deployment; exploitation status: theoretical to low‑skill local exploitation (MEDIUM CONFIDENCE); attacker motivation: unauthorized access to OT systems and downstream enterprise resources (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: low‑privilege local attacker can use standard memory‑dump tools — HIGH CONFIDENCE.
• Scope of impact: multiple critical infrastructure sectors globally — MEDIUM CONFIDENCE.
• CVSS score 5.8 indicates moderate severity with potential for privilege escalation — HIGH CONFIDENCE.
• Availability of a vendor patch reduces long‑term risk but immediate exposure remains for unpatched systems — MEDIUM CONFIDENCE.

Business Impact

Compromise of extracted credentials can lead to unauthorized control of incident management workflows, causing operational downtime of facility safety systems and potential safety incidents. In jurisdictions subject to GDPR, NIS2, or DORA, exposure of authentication data may trigger breach notification obligations with fines up to €20 million or 4 % of global turnover. Financial exposure includes remediation costs, potential production loss, and reputational damage that can erode stakeholder trust in critical infrastructure operators.

Technical Analysis

The vulnerability resides in the Simplex Incident Manager application’s runtime memory handling, where passwords and authentication tokens are retained in cleartext. An attacker with local, low‑privilege access can invoke memory‑dump utilities (e.g., ProcDump) to read the process memory of SimplexIncidentManager.exe, extract credentials, and reuse them to gain privileged access to the application and any integrated OT control systems. The root cause is insecure in‑memory storage of sensitive data (cleartext), classified under CWE‑312. Patch releases modify the credential handling routine to encrypt or purge secrets from memory.

CVE Analysis

• CVE‑2026‑27875 — Johnson Controls Simplex Incident Manager ≤ V2.01 — CWE: Not disclosed in advisory — Attack Vector: Local — Authentication Required: None (low‑privilege local) — Patch: Patched version released by vendor.

MITRE ATT&CK Mapping

• Credential Access → T1003 OS Credential Dumping — attacker reads process memory of Simplex Incident Manager to obtain cleartext credentials.

IOC Intelligence

No public IOCs confirmed at time of publication.

Defenders should build hunt rules around the following behavioral indicators:

• Execution of known memory‑dump utilities (e.g., ProcDump, Taskmgr with “/memdump”) targeting SimplexIncidentManager.exe.
• ProcessAccess events where a low‑privilege process reads the memory of SimplexIncidentManager.exe.
• Creation of temporary files containing extracted credential strings in user profile directories.
• Subsequent authentication attempts to Simplex Incident Manager or connected OT systems using newly harvested tokens.

Detection Engineering Guidance

Collect Sysmon Event ID 10 (ProcessAccess) and filter for TargetImage containing “SimplexIncidentManager.exe” with GrantedAccess including “Read”. Correlate with Event ID 1 (ProcessCreate) for known dumping tools. Monitor Windows Security Event ID 4624 for logons originating from accounts whose credentials were extracted, especially from unusual source IPs. In Microsoft Sentinel, enable the “ProcessAccess” and “ProcessCreate” data connectors and create a KQL rule that flags any ProcessAccess where the SourceProcessName is a dumping utility and the TargetProcessName matches the Simplex binary.

Sigma Rules

title: Credential Dumping of Simplex Incident Manager
id: 3f9c2a1e-5b6d-4f8a-9c3e-2d7b6a1f4e9c
status: stable
description: Detects use of memory dumping tools reading the Simplex Incident Manager process memory.
author: CYBERDUDEBIVASH Sentinel APEX
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 10
        TargetImage|contains: 'SimplexIncidentManager.exe'
        GrantedAccess|contains: 'Read'
    condition: selection
falsepositives:
    - Legitimate debugging or forensic activities
level: high
tags:
    - attack.credential_access
    - attack.t1003

Threat Hunting Queries

• Hypothesis: Memory dump of Simplex Incident Manager – Source: Sysmon logs – Query Sysmon EventID=10 where TargetImage contains “SimplexIncidentManager.exe” and GrantedAccess includes “Read”.
• Hypothesis: Execution of dumping utilities – Source: Sysmon EventID=1 – Query Sysmon EventID=1 where Image contains “procdump.exe” or “dumpcap.exe”.
• Hypothesis: Creation of credential files – Source: Windows Security – Query EventID=4663 where ObjectName like “%\\AppData\\Local\\Temp%” and AccessMask includes “ReadData”.
• Hypothesis: Unusual logons using extracted tokens – Source: Windows Security – Query EventID=4624 where AccountName matches accounts seen in memory dump events and LogonType=2 (interactive) from non‑standard workstations.
• Hypothesis: Lateral movement using harvested credentials – Source: Network flow – Query NetFlow for SMB or RDP connections where source host had a recent Simplex Incident Manager memory dump event.

SOC Analyst Playbook

• P0 (0‑1 hr): Search Sysmon for EventID 10 targeting SimplexIncidentManager.exe; if found, isolate the host via network quarantine.
• P0: Capture a memory dump of the affected host for forensic analysis; preserve Sysmon and Security logs.
• P1 (1‑4 hr): Verify patch status on the host; if unpatched, schedule immediate installation of the vendor‑released update.
• P1: Review recent logon events (EventID 4624) for accounts whose credentials may have been exposed; flag anomalous logons.
• P2 (same‑day): Conduct a credential rotation for all accounts used in Simplex Incident Manager.
• P2: Update endpoint detection rules to include the Sigma rule above and ensure alerts are routed to the incident response team.

🔗 Related Intelligence Reports

• Related topic: CISA Adds Two Known Exploited Vulnerabilities to Catalog
• Related topic: OpenAI Overhauls Model Security With Sandboxing, 30-Minute Alerts, and Training Pauses
• Related topic: T-Mobile Physically Cuts Network Cable to Evict Chinese Salt Typhoon Hackers
• Related topic: Defending Against an Active Threat to Siemens S7 Series PLCs
• Related topic: CISA Adds One Known Exploited Vulnerability to Catalog