CVE-2026-34490 describes a vulnerability in the Johnson Controls XAAP Application on Android where sensitive information is stored in cleartext. This flaw enables an attacker who has physical or privileged access to a jailbroken or compromised device to extract sensitive data from the application. The vulnerability affects versions prior to 1.53. There is no vendor advisory or patch information available at this time. The CVSS 4.0 vector indicates local attack vector with low complexity and low privileges required, but the attack surface is limited to compromised devices.

An attacker with access to a jailbroken or compromised Android device running the affected XAAP Application versions can retrieve sensitive information stored in cleartext. This exposure could lead to unauthorized disclosure of sensitive data. However, exploitation requires prior device compromise, limiting the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict device jailbreaking and unauthorized access to devices running the XAAP Application. Monitor for vendor updates addressing this vulnerability.