Johnson Controls (Vendor): news timeline & CVEs

[Control Systems] Johnson Controls security advisory (AV26-1010)

Canada's Cyber Centre alerts administrators to a Johnson Controls Illustra Standard vulnerability and urges updates.

The Canadian Centre for Cyber Security published advisory AV26-1010 on October 7, 2026, covering a vulnerability in Johnson Controls Illustra Standard - L4L China. Versions before 6.0.0.66394 are affected, based on Johnson Controls information as of October 6, 2026. The notice lists no CVE, severity, or evidence of exploitation and tells administrators to review vendor links and apply updates when available.

Canadian Centre for Cyber SecurityOct 7, 15:39 UTC · 1d agoAdvisory 3 sources

Johnson Controls EasyIO FG

CISA says end-of-life Johnson Controls EasyIO FG firmware has hard-coded credential flaws and will not be patched.

CISA published an advisory for Johnson Controls EasyIO FG firmware 2.0b52 and earlier. CVE-2026-27872 and CVE-2026-27873 involve hard-coded credentials and improper privilege management that could give an attacker full device access; both are scored CVSS 7.7 and require local access with high complexity. The series is end-of-life and end-of-support, unsold since before 2019, and no firmware fix will be issued. Operators are told to migrate to EasyIO Neo and keep devices off the internet on segmented building-automation networks. Exploitation is not reported.

CISA Advisoriesupdated Oct 7, 15:39 UTC · 1d agofirst Oct 6, 12:00 UTC · 2d agoAdvisory 3 sources CVE-2026-27872 CVE-2026-278734· 1 read

[Control Systems] Johnson Controls security advisory (AV26-991)

Canada's Cyber Centre warns of vulnerabilities in Johnson Controls EasyIO controllers and urges updates.

On October 2, 2026, the Canadian Centre for Cyber Security issued advisory AV26-991 on Johnson Controls control-system products. As of October 1, 2026, affected versions include EasyIO FG before 2.0b52, EasyIO Neo before 3.3b63 and 3.3b25, and EasyIO FS32 before 3.0b63 and 3.3b63. The centre urges administrators to review Johnson Controls product security advisories and install updates as they become available. No CVE identifiers or observed exploitation are included.

Canadian Centre for Cyber Securityupdated Oct 7, 15:39 UTC · 1d agofirst Oct 2, 13:12 UTC · 6d agoAdvisory 3 sources1

Johnson Controls EasyIO Neo Series EC and CW Controllers

CISA discloses low-severity information exposure CVE-2026-64892 in Johnson Controls EasyIO Neo EC and CW controllers.

CISA republished Johnson Controls advisory JCI-PSA-2026-20 covering information exposure in EasyIO Neo Series EC and CW controllers. CVE-2026-64892 (CWE-200) could let an attacker obtain sensitive information useful for further attacks against the building-automation system. Affected versions are EC V3.3b62 and V3.3b63 and CW V3.3b24 and V3.3b25. CVSS v3.1 is 3.5 (low), and CISA reports no known public exploitation.

CISA AdvisoriesOct 1, 12:00 UTC · 7d agoVulnerability 2 sources CVE-2026-648921

Johnson Controls EasyIO Neo Series EC and CW Controllers

CISA says Johnson Controls EasyIO Neo controllers transmit credentials in cleartext via CVE-2026-64893, with no known exploitation.

CISA republished Johnson Controls advisory JCI-PSA-2026-30 for EasyIO Neo Series EC and CW building-automation controllers. CVE-2026-64893 (CWE-319) could let a network attacker intercept credentials and session data sent in cleartext. Affected versions are EC V3.3b62 and V3.3b63 and CW V3.3b24 and V3.3b25. CVSS v3.1 is 5.4 (medium) with high attack complexity, and CISA reports no known public exploitation.

CISA AdvisoriesOct 1, 12:00 UTC · 7d agoVulnerability 2 sources CVE-2026-648934

Johnson Controls

Timeline5 articles

Related CVEsby mentions

Appears with

[Control Systems] Johnson Controls security advisory (AV26-1010)

Johnson Controls EasyIO FG

[Control Systems] Johnson Controls security advisory (AV26-991)

Johnson Controls EasyIO Neo Series EC and CW Controllers

Johnson Controls EasyIO Neo Series EC and CW Controllers