Critical Johnson Controls Products Vulnerabilities Enables Remote SQL Injection Attacks

Cybersecuritynews • February 1, 2026

Share: View original

CISA issued a critical alert on a severe SQL injection vulnerability in multiple Johnson Controls ICS products.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in Johnson Controls ICS Products CISA issued a critical alert regarding a severe SQL injection vulnerability affecting multiple Johnson Controls industrial control system products. The vulnerability, tracked as CVE-2025-26385, has a maximum CVSS v3 severity score of 10.0, indicating the highest level of risk. It arises from improper neutralization of special elements used in command injection, allowing remote exploitation. 2 sources 59

Extracted Entities

Attack Types (1)

Companies (1)

Johnson Controls