Johnson Controls American Dynamics VMS Vulnerability Prompts Update Advisory

The Canadian Centre for Cyber Security issued advisory AV26-1052 warning of a vulnerability in Johnson Controls’ American Dynamics video management system (ADVMS). The related reporting identifies versions earlier than 3.10 as affected and points to Johnson Controls advisory JCI-PSA-2026-17. The available summaries do not disclose a CVE identifier, severity rating, technical impact, or exploitation status.

The Cyber Centre recommends that users and administrators review the linked advisories and apply necessary updates as they become available. Organizations operating ADVMS should identify deployments running versions below 3.10 and consult the vendor advisory to confirm remediation requirements; the available information does not establish whether version 3.10 is the prescribed fix or whether interim mitigations are available.