CVE-2026-71456, published on 26 October, describes a hard-coded cryptographic key in Johnson Controls' Kantech Entrapass, the software used to manage physical access control systems, including door controllers, badges and site permissions.