Cleartext Storage Vulnerability (CVE‑2026‑34490) in Johnson Controls XAAP Android Risks Confidential Data
What It Is — A cleartext storage weakness in the Fire Solutions Android application (Johnson Controls XAAP Android) allows data saved locally on the device to be read in plaintext. The flaw is tracked as CVE‑2026‑34490.
Exploitability — Exploitation requires physical access to the device or a separate, unrelated compromise; no network access is needed. CVSS v3 base score 3.3 (Low).
Affected Products — Johnson Controls XAAP Android < 1.53 (all prior releases).
Why It Matters for Compliance & Audit Readiness
- SOC 2 Security & Confidentiality criteria mandate encryption of data at rest; cleartext storage directly violates these controls.
- Mapping this gap to the SOC 2 control matrix provides concrete audit evidence that the organization has identified and remediated a control deficiency.
- Continuous monitoring of patch levels across all XAAP devices creates a defensible audit trail and demonstrates due‑diligence to enterprise customers.
Recommended Actions
- Deploy Johnson Controls’ patch – upgrade XAAP Android to version 1.53 or later immediately.
- Enforce device‑level encryption and configure the application to store all data using strong encryption (e.g., AES‑256).
- Record the remediation in your SOC 2 control inventory and capture compliance evidence (patch version, encryption settings) for audit reviews.
Source: CISA Advisory – ICSA‑26‑204‑02