Topic

Building Automation: news, advisories and analysis

7 articlesUpdated 11 Oct 2026

CyberSecureToday covers Building Automation across 7 articles published between 18 Sep 2026 and 11 Oct 2026. The coverage includes 7 vulnerability advisories. 7 advisories are rated critical or high severity, and 1 involves a flaw listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Building Automation most often intersect with BACnet, HVAC Security and Johnson Controls, with Industrial, OT & IoT the most affected sector. The most recent story, “Honeywell IQ4 BACnet Flaw Allows Unauthenticated Denial of Service and HVAC Override”, was published 11 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

NewsIndustrial & OTCritical
Honeywell IQ4 BACnet Flaw Allows Unauthenticated Denial of Service and HVAC Override
Honeywell and CISA issue advisory for IQ4 building automation controllers, patching a critical BACnet/IP stack buffer overflow (CVE-2026-73850).
CST Editorial Desk11 Oct 20268 min read
ThreatsIndustrial & OTCritical
Honeywell Trend Controls IQ4 Building Controllers Vulnerable to Unsigned Firmware Memory Manipulation (CVE-2026-52873)
Critical firmware flaw in Honeywell Trend Controls IQ4 building management controllers allows remote network actors to deploy modified firmware images and seize HVAC control.
CST Editorial Desk8 Oct 20268 min read
ThreatsIndustrial & OTCritical
Johnson Controls EasyIO Neo Controllers Authentication Bypass Flaw CVE-2026-40112 Disclosed by CISA
CISA Advisory ICSA-26-274-05 details a critical authentication bypass flaw in Johnson Controls EasyIO Neo EC and CW series building automation controllers.
Mei-Lin Chen6 Oct 20268 min read
ThreatsIndustrial & OTHigh
Johnson Controls EasyIO Neo Edge Controllers Vulnerable to Cleartext Credential Interception and Data Disclosure (CVE-2026-64892)
CISA advisories ICSA-26-274-04 and ICSA-26-274-05 warn of cleartext credential and session disclosure in Johnson Controls EasyIO Neo building controllers.
CST Editorial Desk2 Oct 20268 min read
ThreatsIndustrial & OTHigh
Johnson Controls Metasys Building Automation Flaw Enables Administrative Session Hijacking CVE-2026-34491
CISA ICS Advisory ICSA-26-225-14 warns of a high-severity stored XSS defect in Johnson Controls Metasys building automation systems risking administrative takeover.
Mei-Lin Chen27 Sep 20268 min read
ThreatsIndustrial & OTHigh
Siemens Desigo CC Building Automation Platform Flaw CVE-2026-34223 Exposes Supervisory Workstations to Arbitrary Script Execution
Siemens issues advisory SSA-330084 for Desigo CC building management systems where improper input validation in graphics files allows arbitrary script execution.
Priya Raman21 Sep 202614 min read
ThreatsIndustrial & OTHigh
KNX Building Automation Protocol Denial-of-Service Flaw Exploited Against Critical Infrastructure
CISA adds KNX industrial building automation protocol vulnerability CVE-2023-4346 to KEV catalog following active exploitation against critical OT facilities.
Tom Verhoeven18 Sep 202610 min read

Latest coverage

Honeywell IQ4 BACnet Flaw Allows Unauthenticated Denial of Service and HVAC Override

Honeywell Trend Controls IQ4 Building Controllers Vulnerable to Unsigned Firmware Memory Manipulation (CVE-2026-52873)

Johnson Controls EasyIO Neo Controllers Authentication Bypass Flaw CVE-2026-40112 Disclosed by CISA

Johnson Controls EasyIO Neo Edge Controllers Vulnerable to Cleartext Credential Interception and Data Disclosure (CVE-2026-64892)

Johnson Controls Metasys Building Automation Flaw Enables Administrative Session Hijacking CVE-2026-34491

Siemens Desigo CC Building Automation Platform Flaw CVE-2026-34223 Exposes Supervisory Workstations to Arbitrary Script Execution

KNX Building Automation Protocol Denial-of-Service Flaw Exploited Against Critical Infrastructure