Critical SQL Injection Vulnerability in Johnson Controls ICS Products

First seen 1 Feb 2026, 22:57 UTC • Cybersecuritynews

•59

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

CISA issued a critical alert regarding a severe SQL injection vulnerability affecting multiple Johnson Controls industrial control system products. The vulnerability, tracked as CVE-2025-26385, has a maximum CVSS v3 severity score of 10.0, indicating the highest level of risk. It arises from improper neutralization of special elements used in command injection, allowing remote exploitation.

How this analysis works

Attack Flow

Continue Reading

Ransomware Threats Targeting Hypervisors Surge Silver Fox APT Exploits PowerG Security Flaws

Critical SQL Injection Vulnerability in Johnson Controls ICS Products

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading