Johnson Controls AC2000 CVE-2026-21661

Upgrade AC2000 to patched versions: version 10.6 Release 10 or later, version 11.0 Release 9 or later, or version 12 Release 3 or later, as confirmed by Johnson Controls security advisory at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories. Organizations unable to immediately patch should implement compensating controls: restrict local interactive logon rights to AC2000 servers/workstations to only essential personnel using Windows group policy (eliminates PR:L attack prerequisite but impacts operational flexibility), enable Windows AppLocker or application whitelisting to prevent unauthorized DLL loading from user-writable directories (may require extensive testing to avoid breaking legitimate AC2000 functionality), apply filesystem ACLs to deny write access to AC2000 installation directory and PATH locations for non-administrative users (reduces attack surface but requires careful permission auditing), and enable enhanced Windows logging for DLL load events via Sysmon or Windows Defender ATP (detection-only, does not prevent exploitation). Monitor AC2000 process behavior for unexpected DLL loads from non-standard paths. Note that compensating controls add administrative overhead and may not prevent all exploitation scenarios involving privileged local accounts.