CVE-2026-71456

HighCVSS 8.5

Published: 26/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

Johnson Controls Kantech Entrapass before 9.20 uses a hard-coded cryptographic key, allowing a padding oracle crypto attack.

Risk Assessment

An attacker can leverage the padding oracle attack to compromise the confidentiality or integrity of protected data.

Recommendation

Update Kantech Entrapass to version 9.20 or later.

Other vulnerabilities in Kantech Entrapass

CVE-2026-71455Medium
Cleartext storage of sensitive information in memory in Johnson Controls Kantech Entrapass allows retrieval of embedded sensitive data. The issue affects Kantech Entrapass before 9.20.

Original NVD description (English source)

Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS