This vulnerability (CVE-2026-21661) in JohnsonControls AC2000 involves an uncontrolled search path element (CWE-427) on Windows platforms. It enables an attacker with limited privileges to influence the search path for configuration files, potentially causing the software to load malicious or unintended files. Affected versions include 10.6 prior to release 10, 11.0 prior to release 9, and 12 prior to release 3. The CVSS 4.0 vector indicates local attack vector with low attack complexity, no user interaction, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker with local privileges to manipulate the configuration file search path, potentially leading to execution of malicious code or unauthorized modification of configuration data. This could compromise the confidentiality and integrity of the affected system. The vulnerability does not require user interaction and has a low attack complexity, increasing the risk on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for unusual file modifications in the application directories. Avoid running the application with elevated privileges where possible.