Johnson Controls Names Two Patched HTTP2Shell Products
Tech GuruQuick Answer
Johnson Controls v2 adds Fire Restaurant System Estimator and Fire Access Control System with fixed versions. Inventory exact deployments, obtain the supported releases, preserve exposure controls, validate physical-security workflows, retain evidence, and keep monitoring the still-active portfolio assessment.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory the two named Fire products, exact installed versions, web and remote-access paths, owners, backups, safety dependencies, and maintenance windows; retain a separate candidate inventory for products still under assessment. Use the v2 product table; do not invent affected-version ranges or label other Johnson Controls products affected while their assessment remains incomplete. Install Restaurant System Estimator v2.06.011-1 and Fire Access Control System v1.00.200.569 through supported channels, while maintaining the documented compensating controls. Confirm installed versions, test access-control and fire-system workflows, review unusual web requests, processes and outbound connections where exposure existed, and retain change evidence.
Last verified: 2026-10-31 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Fire Restaurant System Estimator and Fire Access Control System; other Johnson Controls products remain under assessment |
|---|---|
| Advisory | JCI-PSA-2026-31 v2 |
| CVE | CVE-2026-111497 |
| Authoritative release date | 2026-10-30 14:55:22 UTC |
| Authority revision date | 2026-10-30 20:57:15 UTC |
| Affected versions | The v2 product table identifies the two Fire products as requiring remediation but does not publish affected-version ranges; other products must not be declared affected without later Johnson Controls findings. |
| Fixed version | Fire Restaurant System Estimator v2.06.011-1 and Fire Access Control System v1.00.200.569 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Johnson Controls does not confirm exploitation against its products.; no exploitation claim is inferred. |
What Changed
Johnson Controls JCI-PSA-2026-31 v2 adds two Fire products and their patched versions while the wider portfolio assessment continues.
What To Validate Now
- Inventory. Inventory the two named Fire products, exact installed versions, web and remote-access paths, owners, backups, safety dependencies, and maintenance windows; retain a separate candidate inventory for products still under assessment.
- Establish applicability. Use the v2 product table; do not invent affected-version ranges or label other Johnson Controls products affected while their assessment remains incomplete.
- Remediate. Install Restaurant System Estimator v2.06.011-1 and Fire Access Control System v1.00.200.569 through supported channels, while maintaining the documented compensating controls.
- Validate. Confirm installed versions, test access-control and fire-system workflows, review unusual web requests, processes and outbound connections where exposure existed, and retain change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
These products can support physical-security operations. Coordinate updates with facility and safety owners and avoid unsupported configuration changes during the continuing assessment.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
