Johnson Controls AC2000 EUVD-2026-27865

Requires authenticated local access to Windows systems running AC2000 with at least low-privilege user credentials (CVSS PR:L). Attacker must have write permissions to directories included in AC2000's DLL search path-typically the application's current working directory, user-specific directories, or PATH environment locations that are world-writable by default on Windows. Exploitation requires identifying which DLLs AC2000 loads without using fully qualified paths and determining their search order priority. No special AC2000 feature enablement or non-default configuration required-the vulnerability exists in the application's default DLL loading behavior on Windows platforms. Exploitation is limited by the need for prior local system access (cannot be exploited remotely), making this vulnerability most relevant in insider threat scenarios, workstation compromise chains, or environments where AC2000 runs on multi-user systems with insufficiently restricted local access controls.

Real-world risk is moderate-to-high for organizations using affected AC2000 versions, with risk profile heavily dependent on deployment context. CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact (VC:H/VI:H) with lower availability impact (VA:L), consistent with privilege escalation scenarios where attackers gain control but may not crash systems. The local attack vector (AV:L) and low privileges required (PR:L) mean attackers need authenticated local access first-this is NOT a remote exploitation scenario. However, physical access control systems like AC2000 often run on shared workstations or servers where multiple personnel have login credentials, creating realistic attack opportunities. The low attack complexity (AC:L) indicates exploitation is technically straightforward for an attacker with basic DLL hijacking knowledge. EPSS data not provided, but absence from CISA KEV suggests no confirmed active exploitation campaigns. Primary risk scenarios include insider threats, compromised low-privilege accounts being escalated to system-level access, and lateral movement by attackers who gained initial network access through other means. Organizations should prioritize patching based on: (1) whether AC2000 systems are on shared infrastructure with multiple user accounts, (2) sensitivity of physical access control data, and (3) integration with other critical security systems. Missing data includes EPSS probability score and confirmed POC availability, limiting quantitative risk assessment.

An attacker with low-privilege local credentials on an AC2000 workstation or server identifies the application's DLL dependencies through process monitoring tools. The attacker places a malicious DLL with an identical name to a legitimate AC2000 library in a user-writable directory that appears earlier in the Windows DLL search order, such as the current working directory or a PATH location. When AC2000 launches or performs operations requiring that library, Windows loads the attacker's malicious DLL instead of the legitimate file, executing arbitrary code with the privileges of the AC2000 process (typically SYSTEM or administrative level), granting full control over the physical access control system and potentially connected security infrastructure.