CVE-2026-71456, published on 26 October, describes a hard-coded cryptographic key in Johnson Controls' Kantech Entrapass, the software used to manage physical access control systems, including door controllers, badges and site permissions. The hard-coded key allows a padding-oracle cryptographic attack, which in practice gives an attacker a route to decrypt or forge protected data without knowing the key. The flaw affects Entrapass versions before 9.20. Because Entrapass is the management layer for physical access rather than a data-plane product, the material risk is to the integrity of access records and, depending on deployment, to the credentials that door controllers trust — a building- or estate-level issue rather than a single-site one. Operators should confirm whether their access controllers accept software updates independently of the Entrapass server, since patching the server alone does not necessarily re-key hardware that has already been issued a credential. Rated 8.5 on CVSS 4.0.

• Source article