Johnson Controls Airwall CVE-2026-34492

User interaction is required (UI:A in the CVSS 4.0 vector), meaning the attack cannot succeed without involving a user action on or through the Airwall platform - fully automated exploitation without user participation is not supported, consistent with the SSVC 'automatable: no' rating. No privileges are required (PR:N per the CVSS 4.0 vector), indicating the attacker need not hold a valid account on the Airwall system, though this conflicts somewhat with CWE-73 patterns that often require the attacker to supply input through an application interface - defenders should confirm with the vendor advisory whether the vulnerable endpoint is truly pre-authentication. Exploitation is further limited by the non-default condition that a user must be induced to trigger the vulnerable file-path resolution operation. Specific feature flags, configuration settings, or deployment modes required to expose the vulnerable code path are not detailed in the available data.

The CVSS 4.0 score of 7.0 reflects a genuine network-accessible vulnerability with high confidentiality impact, but the mandatory user interaction requirement (UI:A) materially reduces exploitability compared to zero-interaction remote attacks and prevents fully automated mass compromise. SSVC signals consistently reinforce a measured posture: exploitation status is 'none,' the attack is rated non-automatable, and technical impact is 'partial' - together suggesting this sits below the threshold for emergency escalation. No CISA KEV listing confirms active exploitation, and no EPSS score was supplied, leaving exploitation probability unquantified from available data. The conflict worth noting is that the CVSS 4.0 vector assigns PR:N (no privileges required), yet CWE-73 file-path control often implies some interaction with an authenticated or semi-trusted interface - defenders should verify with the vendor advisory whether unauthenticated access is truly the attack path. On balance, this is a patch-when-able priority for most organizations, not an incident-level response trigger.

A remote attacker identifies an exposed Airwall web interface or API endpoint that accepts user-controlled file path parameters. By crafting a malicious request containing a manipulated path - and inducing an authorized user to interact with it (e.g., via a phishing link or cross-site request) - the attacker causes the server to resolve an unintended file path and return its contents. Sensitive files such as configuration data or internal credentials could be disclosed, producing the high confidentiality impact reflected in the CVSS VC:H metric. No public exploit code has been identified at time of analysis.