Texas Locksmiths Association

11/02/2026

Locksmith Industry Brief — November 2, 2026
1. Priority: Kantech EntraPass vulnerabilities
Johnson Controls disclosed two vulnerabilities affecting every EntraPass version before 9.20:
CVE-2026-71456 — High, CVSS 8.5: a hard-coded cryptographic key permits a padding-oracle attack. It requires local access but only low privileges.
CVE-2026-71455 — Medium, CVSS 5.3: sensitive information can remain readable in process memory.
Johnson Controls lists 9.20 as the unaffected threshold. No official source reviewed reported active exploitation.
Johnson Controls +2
Field action:
Identify every EntraPass server and workstation and record the exact version/build.
Arrange a vendor-supported upgrade to 9.20 or later; back up the database, integrations, encryption material and controller configuration first.
Test doors, schedules, elevators, alarm/video integrations and emergency access after upgrading.
Until complete, restrict interactive and remote access to EntraPass hosts, remove unnecessary local accounts and isolate them from general-purpose workstations.
Protect memory dumps, backups and support packages as sensitive records.
Consider rotating administrative and integration credentials after remediation, particularly if untrusted users previously had local access.
Explain that this is a management-server vulnerability—not a defect in the mechanical locks or field controllers.
2. Schlage publishes consequential LEB/NDEB firmware details
The October release notes now confirm substantial changes for LEB and NDEB firmware 03.22.02. Both add Lenel BlueDiamond Android NFC, HID Crescendo 2300/4300, Wait Time Extensions and Apple NFC Privacy Card Key configuration. They also address credential-read failures caused by audit-queue overflow and failures involving 9958M1 tour/No-Tour credentials.
LEB Firmware 03.22.02 +1
Most importantly, 03.22.02 is a new security baseline and cannot be downgraded below that version.
There is a documentation discrepancy: Allegion’s resource index labels the LEB release 03.22.26, while the linked release-note PDF repeatedly identifies it as 03.22.02.
Schlage +1
Before deploying:
Confirm with Allegion or the ENGAGE portal which LEB build is actually offered.
Use ENGAGE 8.9.0 or later and verify the listed gateway and mobile-app dependencies.
Export audits and document existing firmware and credential technologies.
Pilot on a noncritical opening, then test Wi-Fi check-in, No-Tour programming, mobile credentials, offline access, mechanical override and emergency operation.
Do not fleet-update solely because the version is newer—the non-downgrade restriction changes the rollback plan.
3. Texas proposes a locksmith CE option—no rule change yet
Texas DPS initiated a proposal on October 15 to amend 37 TAC §35.161. It would allow the existing required one-hour ethics component to be satisfied by either one hour of ethics or one hour of code-compliance updates. The Private Security Advisory Board recommended the change. DPS’s rulemaking page still shows no Texas Register publication or adoption date, so the proposal is not currently effective.
Department of Public Safety +1
Practical implications:
Continue following the present CE requirements for renewals.
Training schools and associations can begin preparing a substantive code-compliance course, but should not advertise it as a substitute until adoption.
Watch for Texas Register publication and the formal comment deadline; this would be a useful TLA comment opportunity.
Continue retaining each employee’s approved CE documentation in the company personnel file.
Department of Public Safety
4. HID Linq Mobile release completed; status monitoring improves
HID completed the Linq Mobile iOS 1.0.0 release on October 30. The October 31 Origo maintenance finished at 8:30 a.m. Central—one hour after its originally scheduled ending. All listed services are currently operational. HID also activated an official Origo RSS feed on November 1.
status.origo.hidglobal.com
Use the app first on a noncritical Signo or OMNIKEY SE/Amico reader, and add the RSS feed to the facilities or security monitoring workflow. The recent overruns reinforce the need to check platform status before replacing readers or troubleshooting credential issuance.

Welcome to HID Origo Status Page's home for real-time and historical data on system performance.

11/02/2026

You ready....

10/24/2026

Come and see us at MHS Locksmith Supply today!
We will be here until 2!

10/05/2026

Locksmith Industry Brief — October 5, 2026
1. Johnson Controls EasyIO controller vulnerabilities
Johnson Controls published five EasyIO advisories on October 1, affecting EasyIO Neo, FG and FS-32 building-automation controllers. Reported issues include cleartext transmission that could expose credentials or session data, sensitive-information disclosure and inadequately protected hardware debug interfaces.

This is adjacent to access control but important in hospitals and large facilities where building automation shares networks or operational integrations.
Action:
Ask facilities/IT whether EasyIO EC, CW, FG or FS-32 controllers are installed.
Record the exact model and firmware; affected-version thresholds differ between advisories.
Keep EasyIO controllers off the access-control and general business networks wherever possible.
Obtain model-specific firmware guidance directly from Johnson Controls before updating.
After remediation, rotate controller and integration credentials that might have crossed an exposed connection.
Do not treat this as a lock failure—the locksmith’s role is identifying shared infrastructure and protecting door-system boundaries.
No confirmed active exploitation was identified in the official material reviewed.
2. New BHMA editions for low-energy operators and door hardware
BHMA now lists ANSI/BHMA A156.19-2026 as the current standard for power-assist and low-energy swinging-door operators, replacing the 2019 edition. The standard covers single doors, simultaneous pairs and dual-egress operators, including provisions intended to reduce injury and entrapment. �
buildershardware.com +1
BHMA also lists:
A156.6-2026 for protection plates, pulls, push plates, edgings and vertical-rod guards.
A156.8-2026 for overhead stops and holders.
buildershardware.com +1
Practical implications:
Update new specifications and purchasing templates that still cite A156.19-2019 or the 2021 A156.6/A156.8 editions.
For hospital operator work, document activation method, opening/closing performance, signage, safety checks and the edition used.
Verify that replacement overhead stops and holders are appropriate for the door weight, expected cycle count and abuse level.
These publications do not automatically require retrofitting existing Texas openings; contract documents, adopted codes and the AHJ still control.
3. Credential-cloning warning from cruise-vessel research
CERT/CC published research showing a cruise-vessel access installation where the reader reportedly authorized an NTAG212 credential using its UID without validating stronger card data. Brief proximity to a valid credential could therefore permit cloning. No identified manufacturer or public remediation was included, so the scope remains uncertain and should not be generalized to all hospitality systems.
For hospitality or multifamily assessments:
Ask the system manufacturer whether authorization relies on UID/CSN alone or authenticated credential data.
Do not assume a printed serial number, proprietary card appearance or data resembling a signature is actually verified by the reader.
Recommend encrypted credentials and diversified keys where supported.
Document the reader model, credential technology and vendor’s written security response before proposing wholesale replacement.

09/28/2026

Locksmith Industry Brief — September 28, 2026
1. HID Mobile Access problem affecting iPhone 17
HID is investigating intermittent Bluetooth failures involving the HID Mobile Access app and Origo SDK on iPhone 17 models running iOS 26.6 or later. Rebooting the phone temporarily restores BLE operation; HID recommends installing the latest available iOS update. The investigation remained open this morning.
status.origo.hidglobal.com
For mobile-credential sites:
Warn affected users before they are locked out at a reader.
Have security desks retain physical badges or another credential for critical staff.
Reboot the phone before replacing, resetting or recommissioning the reader.
Record phone model, iOS version, app version and failed opening when escalating to HID.
Hospitals should verify that on-call and emergency personnel have a non-phone fallback credential.
HID also reported a brief Linq Cloud disruption today, but says corrective action is complete. Key and Format Authorization is currently operational.
2. Schlage releases important LE, NDE and AD-Series firmware
Schlage released LE 01.18.01 on September 22 and NDE 02.23.01 on September 23. Both address credential-read failures caused by audit-queue overflow, improve No-Tour programming retries, correct problems with 9958M1 cards and add Lenel BlueDiamond Android NFC support.
LE Firmware 01.18.01 +1
The major caution: LE 01.18.01 becomes a new security baseline and cannot be downgraded below that version.
Field action:
Pilot LE firmware on a noncritical opening before updating a hospital or campus population.
Confirm ENGAGE 8.9.0, mobile-app and gateway compatibility first.
Export audits and record existing firmware, programming and credential technologies.
Test offline operation, No-Tour updates, mobile credentials, mechanical override and emergency access after upgrading.
Do not update LE locks merely to troubleshoot an unrelated mechanical or Wi-Fi problem—the rollback limitation matters.
AD-Series package AD.A.147 also adds BlueDiamond Android NFC and HID Crescendo 2300/4300 support while correcting several NFC and MIFARE reading problems. MT/MTK readers manufactured before August 2016 are excluded and must remain on AD.A.144.
AD.A.146.3
3. NFPA 101’s 2027 edition is now published
NFPA now lists the 2027 Life Safety Code as an available edition, resolving the previously uncertain publication status.
nfpa.org
This does not immediately change Texas work:
Continue inspecting and specifying against the edition adopted by the state, facility or local AHJ.
Add the 2027 edition to upcoming TLA code education and begin comparing Chapter 7 locking and egress provisions.
Record the governing edition on electrified-locking, delayed-egress and controlled-egress submittals.
Do not describe proposed-development language as enforceable final text without checking the published edition and local adoption.
Quiet categories
Texas licensing: The September 25 Texas Register contains no new DPS/TOPS locksmith rule, fee or application requirement.

sos.texas.gov
NASTF: No confirmed VSP, SDRM, fee, credentialing or additional Autel-tool enforcement change was identified.
Recalls and vulnerabilities: No new consequential commercial door-hardware recall or CISA advisory affecting locks or access controllers was found.
Mechanical hardware: No discontinuation or product notice requiring an inventory change was identified.
Rumors: None elevated to confirmed status.

09/24/2026

Because so many asked!

09/24/2026

What a great turnout for TLA last week. Thank you to everyone who stopped by our booth to either check out some product or just to say hello! Looking forward to next year!

Texas Locksmiths Association

09/24/2026

09/24/2026

09/18/2026

Tonight!!!
Make sure you bring proof of membership to enter the meeting room!