Summary
- CVE-2026-71456 concerns hard-coded cryptographic key material.
- The vendor-assigned CVSS v4.0 score is 8.5, with local access and low privileges required.
- The disclosure does not establish remote door unlocking or confirmed physical access compromise.
A high-severity cryptographic vulnerability in software used to administer building access-control systems may undermine the protection of information handled by affected installations, according to a newly published Johnson Controls security disclosure.
CVE-2026-71456 concerns Kantech EntraPass releases earlier than version 9.20. Johnson Controls supplies building management, physical security and access-control technology used across commercial and infrastructure premises.
EntraPass is used to manage electronic access control, including the records and configurations associated with authorised entry through connected systems. It operates within a broader architecture that can involve workstations, controllers, credentials and site-specific integration services.
The published vulnerability record identifies hard-coded cryptographic key material in the affected software, assigning the weakness to CWE-321. Rather than being generated and independently protected for a particular installation, a hard-coded key is incorporated directly into a program or its components.
That design may weaken encryption where the same protected value is reused or can be discovered through inspection of software accessible to an attacker. The consequences depend on what the key is intended to protect and how the application handles encrypted information.
The record also associates the vulnerability with a padding-oracle attack. Such attacks exploit information revealed by an application when it processes incorrectly padded encrypted data, potentially allowing an attacker to infer protected information under the right circumstances.
The public description does not provide enough technical detail to identify precisely which records, settings or operational functions could be manipulated in the EntraPass environment. Claims of successful door unlocking or unrestricted building access would therefore exceed the disclosed evidence.
Johnson Controls assigned the issue a CVSS v4.0 score of 8.5, categorised as high severity. The published attack model specifies local access, low privileges and no additional user interaction.
Those prerequisites are distinct from an unauthenticated internet attack. An adversary would need a local position and some established privileges before attempting to exploit the vulnerable cryptographic handling.
This does not make the weakness harmless. An attacker with access to an endpoint, limited account or maintenance environment may be able to use an additional local defect to reach information or functions beyond the original permission set.
Access-control platforms occupy a sensitive position because they connect ordinary IT administration with physical premises security. They may process details about people, credentials, entry events and controller configuration, depending on the installation.
The confidentiality and integrity of those records can matter during incident response, particularly when an organisation needs to establish who was authorised to enter a site or whether an administrative change was legitimate.
However, physical safety and access-control equipment often incorporates separate mechanisms that must not be assumed to fail because the associated management application contains a cryptographic defect.
EntraPass may also be maintained through an installer or facilities-management partner rather than directly by an internal IT team. Applying a software correction can therefore require coordination with the supplier and validation against connected controllers.
The CVE record identifies version 9.20 as the relevant boundary, but the reviewed public source material did not provide a detailed independently verified migration procedure or establish whether every older installation can update without further compatibility work.
Organisations should therefore use the vendor's official security guidance when examining installed versions and planning remediation. The existence of a corrected version boundary does not prove that every downstream deployment has received the update.
This also affects incident response: evidence that a limited account accessed an affected local application would require a different assessment from evidence of an external probe against a public interface. The published scoring assumptions make local access part of the reported vulnerability, and they should be preserved in any headline, excerpt or risk summary.
The public disclosure does not identify confirmed exploitation of CVE-2026-71456 against customer environments. It establishes a high-severity weakness with a local attack model, while the precise sensitive information exposed and operational consequences require further vendor detail.
