This vulnerability (CVE-2026-34492) in Johnson Controls Airwall allows an attacker to externally control the file name or path, which can result in unauthorized file manipulation. The issue affects versions prior to 4.1. It is classified under CWE-73 (External Control of File Name or Path). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, with lower impact on integrity and availability. No official patch or fix information is available at this time.

Successful exploitation could allow an attacker to manipulate files on the affected system, potentially leading to unauthorized access or modification of files. The high severity rating reflects the significant confidentiality impact, with some impact on integrity and limited impact on availability. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is available, users should monitor vendor communications for updates. Until a fix is released, exercise caution with user inputs that could influence file paths and consider applying any available workarounds recommended by the vendor.