CVE-2026-64887 & CVE-2026-34492: Johnson Controls Airwall Hard-Coded Key and Path Traversal — Detection and Remediation Guide

CISA has published ICS advisory ICSA-26-225-03 covering two vulnerabilities in Johnson Controls Inc. Airwall, the zero-trust micro-segmentation platform deployed across critical infrastructure worldwide. Successful exploitation of these flaws could allow an attacker to decrypt sensitive data, bypass authentication controls, read arbitrary files from the underlying system, and gain unauthorized access to protected resources.

For a product whose entire value proposition is encrypting and controlling east-west traffic, a hard-coded cryptographic key is about as serious a defect as you can ship. If you run Airwall — particularly in Critical Manufacturing, Commercial Facilities, Government Services, Transportation, or Energy environments — treat this as a priority remediation item. Airwall sits in the trusted path of your segmented network; an attacker who owns the platform owns the segmentation policy itself.

Technical Analysis

Affected Products and Versions

• Product: Johnson Controls Inc. Airwall
• Affected versions: Airwall <= 4.0.4
• CVEs: CVE-2026-64887, CVE-2026-34492
• CVSS v3: 6.8
• Vendor: Johnson Controls Inc.
• Deployment: Worldwide; headquarters in the United States
• Source: CISA ICSA-26-225-03

Vulnerability Breakdown

The advisory describes two distinct weakness classes:

1. Use of Hard-coded Cryptographic Key (CWE-321) — CVE-2026-64887

A cryptographic key is embedded directly in the Airwall software. Any attacker who obtains the binary, firmware image, or a single compromised node can extract the key — and because it is hard-coded, the same key protects other deployments running the vulnerable versions. Consequences per the advisory include decryption of sensitive data in transit or at rest and authentication bypass. This is the classic pattern that turns a single product vulnerability into a fleet-wide trust failure: you cannot rotate your way out of a key that is compiled into the code; you need a vendor patch.

2. External Control of File Name or Path (CWE-22) — CVE-2026-34492

A path traversal flaw allows attacker-supplied input to influence file system paths, enabling arbitrary file reads on the underlying Airwall platform. The practical impact chain is straightforward: request a path outside the intended directory, retrieve /etc/passwd, configuration files, TLS private keys, or credential stores, then use that material to deepen access to protected system resources.

Why This Combination Is Dangerous

Individually, a 6.8 CVSS v3 score might not trigger an emergency change window. In combination, these weaknesses are far more concerning:

• Path traversal yields private keys and configuration secrets from the file system.
• The hard-coded key enables decryption of intercepted traffic and undermines the authentication model.
• Airwall nodes typically sit at segment boundaries with visibility into — and control over — protected traffic flows. Compromise collapses the segmentation trust boundary.

Exploitation Status

At the time of publication, CISA has not reported confirmed in-the-wild exploitation, and neither CVE appears in the CISA Known Exploited Vulnerabilities catalog. However, ICS advisories of this nature historically attract both researchers and attackers quickly once technical details circulate, and hard-coded key extraction does not require sophisticated exploitation — just access to the firmware image. Treat exploitation as a matter of when, not if, and patch on the fastest change window your operational technology environment allows.

Detection & Response

This is a technical ICS vulnerability, so the following detections target the observable behaviors: path traversal attempts against Airwall web/API interfaces, suspicious file reads of sensitive system paths, and post-exploitation process behavior on Airwall Linux-based appliances and servers.

Sigma Rules

---
title: Path Traversal Attempt Against Airwall Web Interface
id: 3f8c2a71-9b54-4e6d-a1c8-7d2e5f9b0c34
status: experimental
description: Detects directory traversal sequences in HTTP requests directed at Johnson Controls Airwall web or API services, consistent with CVE-2026-34492 exploitation attempts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-03
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/13
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
      - '..\\'
      - '%252e%252e'
  selection_target:
    cs-uri|contains:
      - '/api/'
      - '/download'
      - '/file'
      - '/config'
      - '/log'
  condition: selection_uri and selection_target
falsepositives:
  - Legitimate application use of relative paths (rare in API contexts)
level: high
---
title: Sensitive File Read Attempt on Airwall Appliance
id: 8a1e4d62-7c39-4f58-b2e1-9a6c3d5f8e27
status: experimental
description: Detects web requests attempting to retrieve sensitive Linux system files, consistent with post-traversal arbitrary file read against Airwall systems (CVE-2026-34492).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-03
  - https://attack.mitre.org/techniques/T1083/
author: Security Arsenal
date: 2026/08/13
tags:
  - attack.discovery
  - attack.t1083
  - attack.credential_access
  - attack.t1552
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - '/etc/passwd'
      - '/etc/shadow'
      - '/etc/ssl/private'
      - 'id_rsa'
      - '.ssh/authorized_keys'
      - '/etc/airwall'
      - 'private.key'
      - 'server.key'
      - 'credential'
  condition: selection
falsepositives:
  - Internal vulnerability scanning (validate scanner source IP)
level: high
---
title: Airwall Process Spawning Unusual Shell or Command
id: c5b7f1a4-2d68-4a93-9e5b-1f4c8d6a3e92
status: experimental
description: Detects the Airwall service process or associated web server spawning shells or system utilities, indicating potential post-exploitation activity following authentication bypass (CVE-2026-64887).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-03
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/13
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'airwall'
      - 'nginx'
      - 'lighttpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - Airwall upgrade or diagnostic scripts executed by vendor tooling
level: critical

KQL (Microsoft Sentinel / Defender)

Hunt for traversal and sensitive-file-read attempts against Airwall assets ingested via Syslog/CEF from your web servers, reverse proxies, or network sensors. Tune the destination host list to your Airwall conductors, servers, and gateway appliances.

// Hunt: Path traversal and sensitive file read attempts against Airwall infrastructure
// Ingests web/proxy logs via CEF or Syslog into CommonSecurityLog
let AirwallHosts = dynamic(["airwall-conductor", "airwall-server", "airwall-gw"]); // TODO: replace with your Airwall asset hostnames/IPs
let TraversalPatterns = dynamic(["../", "..%2f", "%2e%2e%2f", "%252e%252e", "..\\"]);
let SensitiveFiles = dynamic(["/etc/passwd", "/etc/shadow", "/etc/ssl/private", "id_rsa", "authorized_keys", "server.key", "private.key", "/etc/airwall"]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationHostName has_any (AirwallHosts) or DestinationIP in (AirwallHosts)
| extend Uri = coalesce(RequestURL, AdditionalExtensions)
| where Uri has_any (TraversalPatterns) or Uri has_any (SensitiveFiles)
| summarize AttemptCount = count(), DistinctURIs = dcount(Uri), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), SampleURIs = make_set(Uri, 10)
  by SourceIP, DestinationHostName, DestinationIP
| order by AttemptCount desc;

// Hunt: Shell or utility execution under Airwall-related parent processes (Linux Syslog audit/process data)
Syslog
| where TimeGenerated > ago(7d)
| where HostName contains "airwall"
| where SyslogMessage has_all ("execve", "audit")
  and (SyslogMessage has_any ("/bin/sh", "/bin/bash", "/usr/bin/curl", "/usr/bin/wget", "/usr/bin/nc", "python3"))
| project TimeGenerated, HostName, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;

Velociraptor VQL

Use this artifact on Linux-based Airwall servers where you have a Velociraptor client deployed (typically the Airwall Server/Conductor VMs rather than embedded gateways). It hunts for suspicious child processes and evidence of credential/key file access staging.

-- Hunt: Airwall post-exploitation -- shell/utility spawning and staging of key material
SELECT Pid, Ppid, Name, Exe, Cmdline, Username, CreateTime
FROM pslist()
WHERE Cmdline =~ '(curl|wget|nc |ncat|bash -i|sh -i|/dev/tcp|base64)'
   OR (Name =~ '(sh|bash|dash|nc|ncat|curl|wget|python3?)'
       AND NOT Cmdline =~ 'airwall')
ORDER BY CreateTime DESC

-- Hunt: Copies of sensitive files staged outside their expected locations
-- (indicative of exfiltration prep after CVE-2026-34492 arbitrary file read)
SELECT FullPath, Size, Mtime
FROM glob(globs=['/tmp/**/passwd*', '/tmp/**/shadow*', '/tmp/**/*.key',
                 '/var/tmp/**/id_rsa*', '/tmp/**/*.pem', '/var/tmp/**/*.key'])
WHERE Mtime > time(now=now() - 7*24*3600)
ORDER BY Mtime DESC

Remediation / Verification Script

Run the following Bash script on Airwall Linux-based servers (Conductor/Server VMs) and, where shell access is available, gateway appliances. It verifies the installed version, captures the running state for forensic preservation, and checks for indicators of traversal probing in local web logs.

#!/usr/bin/env bash
# Airwall CVE-2026-64887 / CVE-2026-34492 verification and pre-patch triage
# Run as root on Airwall server/VM components. Review output before upgrading.
set -u

echo "=== [1] Installed Airwall version ==="
# Adjust command/path to your deployment; Airwall Server exposes version via package or CLI
(command -v airwall >/dev/null 2>&1 && airwall --version) \
  || (dpkg -l 2>/dev/null | grep -i airwall) \
  || (rpm -qa 2>/dev/null | grep -i airwall) \
  || echo "[!] Version query failed - check Airwall console/Conductor UI"

echo "=== [2] Preserve evidence BEFORE patching (running processes & connections) ==="
mkdir -p /tmp/airwall_triage
ps auxww > /tmp/airwall_triage/ps_$(date +%Y%m%d_%H%M%S).txt
ss -tunap  > /tmp/airwall_triage/netstat_$(date +%Y%m%d_%H%M%S).txt

echo "=== [3] Check web logs for traversal probes (CVE-2026-34492) ==="
for log in /var/log/nginx/access.log /var/log/lighttpd/access.log /var/log/airwall/*.log; do
  [ -f "$log" ] && grep -Ei '(\.\./|%2e%2e|%252e%252e|/etc/passwd|/etc/shadow|id_rsa|\.key)' "$log" \
    | tail -50 && echo "--- matches in $log ---"
done

echo "=== [4] Check for unexpected shells / downloaders under service accounts ==="
ps auxww | grep -Ei '(bash -i|sh -i|/dev/tcp|nc |ncat |curl |wget )' | grep -v grep \
  || echo "[+] No obvious suspicious processes found"

echo "=== [5] Restrict management interface exposure (interim mitigation) ==="
echo "Verify Airwall Conductor/Server management UI is reachable ONLY from admin VLAN/VPN."
echo "Example iptables guard (adjust interface/subnet for your environment):"
echo "  iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/16 -j ACCEPT"
echo "  iptables -A INPUT -p tcp --dport 443 -j DROP"

echo ""
echo "ACTION REQUIRED: If version <= 4.0.4, schedule immediate upgrade per CISA ICSA-26-225-03:"
echo "  https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-03"

Remediation

1. Patch immediately. If you are running Airwall <= 4.0.4, upgrade to the vendor-fixed release as soon as Johnson Controls makes it available. Follow the guidance linked from CISA ICSA-26-225-03 and the Johnson Controls product security portal. Confirm the exact fixed version in the vendor advisory before scheduling the change — do not assume a minor bump remediates both CVEs.
2. Inventory and scope now. Enumerate every Airwall Conductor, Server, Gateway, and agent in your environment. OT and facilities networks frequently contain unmanaged or forgotten gateways; those are exactly the nodes an attacker will find first.
3. Isolate management interfaces. Until patched, restrict access to the Airwall management plane and web/API endpoints to a dedicated administrative VLAN or jump host. Block access from user subnets, building-automation networks, and anything internet-facing.
4. Hunt before you patch. Preserve process lists, network connections, and web/proxy logs (script above) prior to upgrade. If the hard-coded key has been extracted or the traversal flaw has already been used, a patch alone will not evict an attacker.
5. Rotate secrets after patching. Because CVE-2026-64887 involves key material embedded in the software, assume any deployment-specific keys, certificates, and credentials stored on or transiting vulnerable nodes may be compromised. Rotate TLS private keys, API tokens, and service account credentials as part of the remediation — not weeks later.
6. Review logs for the past 90+ days. Arbitrary file read flaws are quiet. Search proxy, WAF, and appliance logs for traversal sequences and requests for /etc/passwd, /etc/shadow, .key, .pem, and SSH material directed at Airwall assets.
7. Apply CISA's standing ICS mitigations. Minimize network exposure of control system devices, place them behind firewalls, and isolate them from business networks. Use VPN or zero-trust access for any required remote administration.
8. Validate segmentation integrity post-patch. Airwall is itself a segmentation control. After remediation, test that group policies, port permissions, and trust configurations match your documented baseline — an attacker with platform access could have altered them.

The Bottom Line

Hard-coded cryptographic keys in a product designed to be your encryption and segmentation layer is a foundational trust failure, not a routine patch Tuesday item. The path traversal flaw gives attackers a low-noise mechanism to harvest the very secrets that make the first flaw catastrophic. Patch Airwall <= 4.0.4, rotate your secrets, hunt for pre-patch access, and verify your segmentation policy survived intact.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub