Johnson Controls ADVMS CVE-2026-34499

Exploitation requires local access to a system running Johnson Controls ADVMS at a version before 3.10, plus low-level privileges sufficient to read the application's executable/constants (CVSS AV:L, PR:L, AT:N, UI:N). The core condition is simply that the vulnerable ADVMS binary contains the hard-coded cryptographic key - this appears to be an inherent property of affected builds rather than a non-default configuration toggle. Limiting factors that reduce real-world risk: there is no network attack vector (an attacker cannot trigger this remotely without first gaining local access), authentication/low privileges are needed, and only ADVMS installations below version 3.10 are affected; upgrading to 3.10 or later removes the condition.

This is a use-of-hard-coded-cryptographic-key flaw (CWE-321) in Johnson Controls ADVMS, scored CVSS 8.5 via the vendor-supplied CVSS 4.0 vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. The signals are internally consistent but point to a locally-exploitable, authenticated issue rather than a remotely wormable one: AV:L means the attacker needs local access (or an already-running process context) to the executable, and PR:L means some level of authenticated/low privilege is required, which substantially lowers real-world urgency despite the HIGH severity band. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept was supplied - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The high CVSS is driven by the triple VC:H/VI:H/VA:H impact rating (reading a hard-coded key can cascade into confidentiality, integrity, and availability loss across protected data/comms), but the local attack vector and privilege requirement make this a moderate-priority patch-management item for ADVMS operators rather than an emergency. Note a mild tension to verify with the vendor: the description frames the consequence narrowly as 'Read Sensitive Constants Within an Executable' (a confidentiality/key-extraction primitive), yet the CVSS asserts HIGH integrity and availability impact - the I/A impact is presumably downstream of key compromise and should be confirmed against Johnson Controls' advisory.

An attacker with local, low-privilege access to a host running Johnson Controls ADVMS extracts a hard-coded cryptographic key embedded in the application binary by reading sensitive constants from the executable. With the recovered key they can decrypt protected data or forge/tamper with cryptographically protected communications or stored credentials, undermining the confidentiality and integrity the key was meant to protect. No public exploit code is known at time of analysis, and exploitation requires local access plus low privileges per the CVSS 4.0 vector.