The vulnerability identified as CVE-2026-64887 affects Johnson Controls Airwall versions prior to 4.1. It involves the use of a hard-coded cryptographic key, which can be exploited through cryptanalytic attacks. This type of vulnerability compromises the confidentiality and integrity of cryptographic operations by allowing attackers to potentially derive the key and decrypt or manipulate protected data. The CVSS 4.0 vector indicates local attack vector with low attack complexity and no privileges or user interaction required, with high impact on confidentiality and low impact on integrity. No known exploits in the wild or vendor patch information are currently available.

The use of a hard-coded cryptographic key undermines the security of cryptographic functions in affected versions of Johnson Controls Airwall, potentially allowing attackers to perform cryptanalytic attacks to recover sensitive information. This can lead to unauthorized data disclosure or manipulation. The vulnerability has a high severity rating based on the CVSS 4.0 assessment, indicating significant risk to confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of affected systems and monitor for updates from Johnson Controls regarding patches or mitigations.