CVE-2026-21661

HighCVSS 8.4/10Last modified Oct 26, 2026

Description

An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths.

This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

Metrics

CVSS 4.0 8.4/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-427

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Johnson Controls	AC2000	>= 10.6, < release 10; >= 11.0, < release 9; >= 12, < release 3

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Timeline

Published: May 6, 2026
Last modified: Oct 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-216629.8Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This is CVE-2026-216636.1HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An CVE-2026-216646.1HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Rev CVE-2026-216657.7The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.31 CVE-2026-216668.8A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-216678.8A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-216686.5A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.CVE-2026-216699.9A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-21678.8A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/CVE-2026-216706.5A vulnerability allowing a low-privileged user to extract saved SSH credentials.CVE-2026-216719.1A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availabilit CVE-2026-216728.8A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.