CVE-2026-64896: Debug and Test Interface With Improper Access Control in Johnson Controls T2000

This vulnerability in Johnson Controls T2000 arises from improper access control on a debug and test interface, enabling access to functionality that should be restricted by ACLs. The issue affects versions prior to 31.6. The CVSS 4.0 base score is 5.2, reflecting low attack vector (physical), low attack complexity, no privileges or user interaction required, no confidentiality or integrity impact, limited availability impact, and no scope or security requirements changes. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Exploitation of this vulnerability could allow an attacker with physical access to the device to access debug and test functions that are not properly restricted, potentially impacting system availability. There is no impact on confidentiality or integrity. The vulnerability does not require privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to affected devices to mitigate risk.