The Fire Alarm Workstation Got a Federal Advisory

Summary

On 20 Aug 26 the federal government published a cyber advisory about fire alarm software. It came from the Cybersecurity and Infrastructure Security Agency (CISA), the federal office that warns the country about computer threats to its infrastructure. The product is Simplex Incident Manager, made by Johnson Controls. It is the software a large facility uses to watch its fire alarm system.

The flaw is plain. While the software runs, user passwords sit in the computer's memory with no encryption. Anyone who can get onto that machine with the right tools can read them out. Nobody has been caught exploiting it, and the fix is already published.

The event is small. The meaning is bigger. The software that runs a building's fire alarm now gets the same federal advisories as any other computer system. The fire alarm trade is the one holding it.

Findings

Simplex Incident Manager is a monitoring workstation sold for large buildings, places like a hospital campus or an airport. One install can watch up to 687 fire alarm control panels and 250,000 individual devices. A control panel is the cabinet that runs a building's smoke detectors and horns. The workstation shows all of it on web pages, so an operator can check the system from a desktop or a phone.

The flaw carries the file number CVE-2026-27875. A CVE is a public record for one specific software flaw, so everyone can point at the same hole by the same name. This one belongs to a known failure class, cleartext storage of sensitive information in memory. In plain terms, the program keeps passwords and login tokens readable while it runs. A person with an account on that machine, even a low-level one, can dump the memory and collect them. The stolen credentials can then open the application and the systems connected to it.

CISA scores the flaw 5.8 out of 10, a medium. The attacker has to be on the machine already, the attack is rated high complexity, and no exploitation has been reported. Johnson Controls' own record scores it 6.9 under a newer scoring method, still a medium. Johnson Controls found the flaw and reported it to CISA itself. That is the disclosure system working the way it should.

The vendor advisory, numbered JCI-PSA-2026-28, covers two brands at once, Simplex Incident Manager and Autocall Fire Administrator. Same software, two labels. The patched version is 2.01.01. The same advisory also tells users to upgrade to version 1.01.05 or later, and the CVE record lists everything below 2.01.05 as affected. Three version numbers in one advisory. The technician doing the upgrade gets to sort that out.

The advisory did not arrive alone. It is the 28th product security advisory Johnson Controls has published in 2026. The year's list already includes the company's building automation line and its access control line. The software layer of the modern building keeps needing patches. The fire alarm just joined that list in public.

Impact

CISA lists energy among the sectors running this software, alongside government and transportation facilities. The buildings involved are the ones this trade wires every day.

The timing is the story. NFPA 72 is the national fire alarm code. In 2016 it added Class N, a pathway class for fire alarm equipment that talks over a network. In 2022 it added a cybersecurity chapter, Chapter 11, written mostly as advisory notes. In the 2025 edition that language became enforceable requirements. Tom Hammerberg is a fire alarm consultant who sat on one of the code's technical committees. He writes that the chapter applies to installation and testing companies, along with the manufacturers and the people running the facility.

Where the 2025 edition is adopted, a networked fire alarm system needs a documented cybersecurity plan. Default passwords get changed at commissioning, and remote programming needs multi-factor authentication (MFA), a second proof of identity beyond the password. Every remote session gets logged.

Hold those two facts together. The code now requires the fire alarm shop to manage credentials with discipline. The advisory says the management workstation held its credentials unencrypted in memory. The requirement and the flaw landed in the same year, on the same machine.

The practical read for the trade: the workstation is a server. The technician who installs and services it is doing system administration work, whether anyone trained him for it or not. He is also the only person on site who knows what that workstation actually touches. The people who write the advisories have never seen the building.

For the building owner, nothing here says you are being attacked. It says your fire alarm system has a software layer, and that layer needs the same care as any other computer you own.

Recommendations

If you service Simplex Incident Manager or Autocall Fire Administrator, check the version this week. Get the patch on and write the new version into the system records. Cut the list of local accounts on the workstation down to the people who need them. If your jurisdiction runs the 2025 code, the maintenance plan already needs a step for removing credentials when someone leaves. Write it now, before an inspector asks for it.

If you write specifications, ask every vendor for their security advisory feed the same way you ask for data sheets. Johnson Controls publishes theirs on a public page. Most vendors do.

If you run a building with this software in it, ask your fire alarm contractor one question. Who has a login to that workstation? The answer should be a short list with names on it.