Simplex Incident Manager CVE-2026-27875

Exploitation requires local, authenticated access to the host system running Simplex Incident Manager / Autocall Fire Administrator with at least low-privilege credentials (AV:L, PR:L). A specific prerequisite condition must be satisfied (AT:P) - likely the application being in an active authenticated session or a particular operational mode where sensitive data is loaded into memory - making purely passive or persistent memory scraping insufficient. High attack complexity (AC:H) further requires attacker knowledge of the application's memory layout or use of appropriate tooling. Exploitation is not remotely exploitable in its base form. Factors limiting exploitation include: mandatory local authenticated access, high attack complexity, a required specific application state, and the fact that the SC:H subsequent-system impact applies only in environments where Simplex credentials are also valid on connected fire or building management systems.

The CVSS 4.0 score of 6.9 represents a moderate-to-high rating, but real-world exploitability is materially constrained by several factors in the vector. The local attack vector (AV:L) eliminates remote opportunistic exploitation, requiring physical or authenticated local presence on the application host. High attack complexity (AC:H) combined with the AT:P prerequisite condition further reduces the realistic attacker pool - exploitation likely requires knowledge of the application's internal operational state and timing. No EPSS score is available in the provided intelligence, and there is no CISA KEV listing and no confirmed public POC, indicating no known active exploitation. The primary threat model is an insider or a post-compromise lateral mover who has already established a local foothold. The SC:H impact elevates urgency specifically in environments where Simplex credentials are shared with or reused across connected fire safety infrastructure, as credential theft could pivot into safety-critical systems. For isolated deployments with strong physical access controls, risk is substantially lower despite the CVSS rating.

A low-privilege local user - such as a facilities technician with workstation access or a compromised service account - waits for or triggers an active session state in the Simplex Incident Manager application, then uses a memory inspection tool to scan the application's process memory and extract cleartext credentials or sensitive tokens. No public exploit code has been identified; the AT:P prerequisite indicates a specific application state must exist for the sensitive data to be present in recoverable form. Retrieved credentials could subsequently be used to authenticate to connected fire alarm panels or building automation systems that share those credentials.