Johnson Controls Fixes Credential Exposure and Hard-Coded Key Flaws in Kantech EntraPass

Johnson Controls has confirmed two vulnerabilities in Kantech EntraPass versions before 9.20, affecting access-control deployments across commercial facilities and building-security environments worldwide. Vendor advisory JCI-PSA-2026-21 lists CVE-2026-71455 and CVE-2026-71456, with CVSS v4.0 scores of 5.3 (medium) and 8.5 (high). One flaw allows sensitive authentication information, including decrypted operator passwords, to remain in plaintext in process memory after an authentication attempt, potentially enabling credential retrieval and reuse. The other involves a hard-coded cryptographic key. Both require local access; the published vectors specify high privileges and user interaction for the first vulnerability, and low privileges without user interaction for the second.

Johnson Controls marks the vulnerabilities as fixed and identifies all versions before 9.20 as affected. The Canadian Centre for Cyber Security amplified the vendor disclosure through advisory AV26-1090, urging administrators to review the vendor guidance and apply necessary updates. Organizations running EntraPass should identify affected installations and upgrade to version 9.20 or a later vendor-supported release. The supplied advisories do not report active exploitation; the local-access requirements make host access restrictions and privileged-account controls relevant safeguards while upgrades are arranged.