CVE-2026-64896: T2000 open debug port

Q: Which deployments are affected?

Johnson Controls T2000 versions before 31.6 are affected. The provided information does not identify any configuration-specific exclusions.

Q: What access would an attacker need?

The CVSS vector indicates that exploitation requires physical access to the affected system. It does not require prior privileges or user interaction.

Q: What is the expected impact of successful exploitation?

The CVSS assessment indicates high impact to availability and low impact to integrity. No confidentiality impact is indicated.

Published Aug 27, 2026

Updated

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects T2000: before 31.6.

Affected Software

1 affected component

Johnson Controls T2000<31.6

Event History

Aug 27, 2026

CVE Published

via MITRE·02:42 PM

Data Sourced

via MITRE·02:42 PM

DescriptionWeakness

Data Sourced

via NVD·05:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Johnson Controls T2000 versions before 31.6 are affected. The provided information does not identify any configuration-specific exclusions.

What access would an attacker need?

The CVSS vector indicates that exploitation requires physical access to the affected system. It does not require prior privileges or user interaction.

What is the expected impact of successful exploitation?