CVE-2026-34490Disclosure(johnsoncontrols / xaap)

LOWCVSS 5.5 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch johnsoncontrols xaap systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.

johnsoncontrols CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Weakness type (CWE)

CWE-312

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

xaap

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked at 3 mentions on most recent observed day (2026-08-01)
4 total mentions across 2 days

Affected systems

Vendors

johnsoncontrols

Products

xaap

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-23	1	Patch1
2026-08-01	3	Disclosure3

Full discourse4 posts

Infoflowcloud@infoflowcloud83d
Disclosure
🚨*CVE* CVE-2026-34490 Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised d… https://www.cve.org/CVERecord?id=CVE-2026-34490 ----- Traducción: CVE-2026-34490 Alm… http://infoflow.cloud`
Post summary
The post simply announces CVE-2026-34490 for Johnson Controls XAAP Android app, highlighting cleartext storage of sensitive data, with no further exploit, mitigation, or deployment details.
0000038
96 followersView on X
CVE@CVEnew83d
Disclosure
CVE-2026-34490 Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised d… https://www.cve.org/CVERecord?id=CVE-2026-34490
Post summary
The post announces CVE‑2026‑34490, highlighting that the Johnson Controls XAAP Android app stores sensitive data in cleartext, potentially exposing it on compromised devices; no exploit, patch, or active exploitation details are provided.
000001.4K
57.9K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds83d
Disclosure
CVE-2026-34490 Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34490
Post summary
The text discloses CVE‑2026‑34490, describing cleartext storage of sensitive data in the Johnson Controls XAAP Android app when device is jailbroken or compromised, without providing any proof of concept, exploit code, or mitigation details.
00000123
4.1K followersView on X
Windows Forum@windowsforum91d
Patch
🔒 XAAP Android users, update to 1.53 or later: CVE-2026-34490 left sensitive app data in plaintext. Nothing says “secure fire systems” like readable secrets on the device. https://windowsforum.com/threads/cve-2026-34490-xaap-android-1-53-fixes-cleartext-data-exposure.440178/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #AndroidSecurity #JohnsonControls #MobileDeviceManagement #Cve202634490 https://t.co/kMEGb2kJQR
Post summary
The tweet warns XAAP Android users that CVE‑2026‑34490 caused cleartext exposure of sensitive data and recommends updating to version 1.53 or later for a fix.
0000058
1.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	johnsoncontrols	xaap	-	android	-

Explore more

Back to dashboard johnsoncontrols CVEs xaap vulnerabilities

What researchers are saying

CVE-2026-34490

Windows Forum[verified]@windowsforumPatch

The tweet warns XAAP Android users that CVE‑2026‑34490 caused cleartext exposure of sensitive data and recommends updating to version 1.53 or later for a fix.

Infoflowcloud@infoflowcloudDisclosure

The post simply announces CVE-2026-34490 for Johnson Controls XAAP Android app, highlighting cleartext storage of sensitive data, with no further exploit, mitigation, or deployment details.

CVE@CVEnewDisclosure

The post announces CVE‑2026‑34490, highlighting that the Johnson Controls XAAP Android app stores sensitive data in cleartext, potentially exposing it on compromised devices; no exploit, patch, or active exploitation details are provided.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text discloses CVE‑2026‑34490, describing cleartext storage of sensitive data in the Johnson Controls XAAP Android app when device is jailbroken or compromised, without providing any proof of concept, exploit code, or mitigation details.