When Building Security Depends on Connected Systems, Cybersecurity Becomes a Physical Security Issue.

 

Commercial buildings are increasingly dependent on connected systems to manage access, building operations, monitoring, and other facility functions.

A critical vulnerability disclosed in July 2026 demonstrates why property operators need to pay attention to the security of the technology behind those systems—not just the physical doors, cameras, and security personnel protecting the building.

CVE-2026-66013, published by the National Vulnerability Database on July 25, 2026, affects OpenRemote versions before 1.26.2 and involves an authentication-bypass vulnerability in the platform’s console registration API. NIST lists the vulnerability with a CVSS 4.0 score of 9.3, classified as critical.

The National Vulnerability Database provides the technical details, affected versions, severity information, and references for CVE-2026-66013.

 

What Happened?

OpenRemote is an open-source platform used to manage connected devices and facility-related systems.

The vulnerability identified in versions before 1.26.2 affects the platform’s console registration API.

According to NIST, an unauthenticated attacker could update an existing console asset by supplying a known asset identifier.

The attacker could potentially overwrite push-notification tokens and console metadata without authentication or ownership validation.

The vulnerability was publicly recorded on July 25, 2026.

OpenRemote versions before 1.26.2 are identified as affected, while version 1.26.2 is listed as unaffected.

 

Why It Matters to Commercial Property Operators

The vulnerability is not a story about every commercial building being compromised.

It is a reminder of something more important:

The systems operating a modern building can become part of its security exposure.

Commercial properties increasingly depend on connected technology for daily operations.

That can include:

• Access control
• Building automation
• Environmental monitoring
• Connected sensors
• Security notifications
• Surveillance integrations
• Remote facility management

When these systems become connected to networks, APIs, cloud services, and remote management platforms, they introduce another layer that property operators need to understand and manage.

 

The Security Gap Is No Longer Just at the Door

A commercial property may have strong physical controls.

It may have security officers in the lobby.

It may have cameras covering entrances.

It may have controlled parking access and restricted areas.

But those physical controls increasingly depend on technology operating behind the scenes.

An access credential may be managed through software.

A security notification may travel through a connected platform.

A building-management system may communicate with remote devices.

A camera may be connected to a cloud management platform.

That creates a broader security environment.

The physical building and the systems operating it can no longer be treated as completely separate security problems.

 

What Commercial Property Operators Should Review

1. Know What Connected Systems Are Operating Your Building

Property operators should maintain an inventory of the systems responsible for access, monitoring, building automation, visitor management, and other connected facility functions.

If the property team does not know what technology is operating the building, it becomes difficult to determine what needs to be monitored or updated.

 

2. Know Which Vendors Manage Those Systems

Connected building technology may be supplied and maintained by multiple vendors.

Property teams should know who is responsible for each platform, who receives security advisories, and who is responsible for applying updates.

 

3. Monitor Vulnerabilities and Vendor Advisories

Connected security systems require ongoing maintenance.

A system that was secure when installed can later contain a newly discovered vulnerability.

Property operators should establish a process for reviewing relevant vendor advisories, vulnerability disclosures, patches, and firmware updates.

 

4. Understand What Happens When Technology Fails

Security planning should account for technology failures as well as physical incidents.

Ask what happens if an access-control platform becomes unavailable.

What happens if notifications stop?

What happens if remote monitoring becomes unavailable?

What happens if a connected system has to be isolated from the network?

The answers should be part of the property’s security and continuity planning.

 

5. Maintain Physical Security as a Separate Layer

Connected technology should complement—not replace—physical security.

Security personnel, patrols, controlled access, lighting, surveillance, visitor management, and response procedures remain important because technology cannot eliminate every physical threat.

 

6. Connect Detection With Response

A vulnerability notification, system alert, or suspicious access event has limited value if nobody is responsible for determining what happens next.

Commercial properties should have defined escalation procedures covering security personnel, property management, vendors, IT teams, and other responsible parties.

 

The Bigger Lesson

CVE-2026-66013 is fundamentally a cybersecurity vulnerability.

But its broader significance for commercial property operators is physical.

Buildings are becoming increasingly connected.

Access control, monitoring, automation, communications, and other facility functions increasingly depend on software and networked systems.

That means the traditional boundary between cybersecurity and physical security is becoming less useful.

The people responsible for protecting a building need to understand both sides of that environment.

 

A More Complete Approach to Commercial Property Security

SPADE Security Services helps commercial property operators build physical security programs around the actual conditions of their buildings, tenants, access points, operating hours, and risk exposure.

Our approach can combine licensed security personnel, patrol, visible deterrence, access management, surveillance, monitoring, incident response, and security documentation based on the property’s specific requirements.

The objective is not to replace technology with people.

It is to make technology and physical security work together.

 

Because a connected building still has to be physically protected.

And when technology becomes part of the security environment, property operators need people who understand what happens when the technology does not work as expected.

 

Your building is connected. Your security strategy should be connected too.

 

Schedule a Commercial Property Security Consultation

 

SPADE Security Services | Rocklin, CA | Veteran-owned | DVBE certified
Serving Placer, Sacramento, and El Dorado counties
Licensed by the California Bureau of Security and Investigative Services
PPO121804

 

 

What is CVE-2026-66013?

CVE-2026-66013 is a critical authentication-bypass vulnerability affecting OpenRemote versions before 1.26.2. NIST describes the flaw as allowing unauthenticated attackers to update existing console assets by supplying a known asset identifier.

 

Does this vulnerability mean commercial buildings were hacked?

Not necessarily. The vulnerability identifies a technical exposure in affected OpenRemote installations. It should not be interpreted as evidence that all commercial buildings using connected building systems were compromised.

 

What should operators using OpenRemote do?

Operators should determine whether their environment uses an affected OpenRemote version and follow the vendor’s remediation guidance. Version 1.26.2 is identified as unaffected by the vulnerability record.

 

Why does this matter to physical security?

Modern facilities increasingly rely on connected systems for security and building operations. A weakness in the technology supporting those systems can therefore create operational and security implications beyond traditional IT environments.

 

Can physical security prevent a cybersecurity vulnerability?

No. Physical security and cybersecurity address different attack surfaces. However, physical security can provide an important additional layer through controlled access, patrol, monitoring, verification, and response when connected systems are unavailable or compromised.

 

Prompt: Modern commercial office building lobby at dusk, glass entrance with controlled badge access turnstiles, security officer at the front desk reviewing a tablet, mounted surveillance cameras, soft interior lighting, professional and calm atmosphere, photorealistic, contemporary architecture, security industry photography.

File Name: spade-security-commercial-property-lobby-access.jpg

Image Alt: Modern commercial office building lobby at dusk with controlled badge access turnstiles and a security officer monitoring entry at the front desk.