Topic

Johnson Controls: news, advisories and analysis

6 articlesUpdated 6 Oct 2026

CyberSecureToday covers Johnson Controls across 6 articles published between 19 Sep 2026 and 6 Oct 2026. The coverage includes 6 vulnerability advisories. 6 advisories are rated critical or high severity.

Stories on Johnson Controls most often intersect with SCADA, Building Automation and EasyIO Neo, with Industrial, OT & IoT the most affected sector. The most recent story, “Johnson Controls EasyIO Neo Controllers Authentication Bypass Flaw CVE-2026-40112 Disclosed by CISA”, was published 6 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsIndustrial & OTCritical
Johnson Controls EasyIO Neo Controllers Authentication Bypass Flaw CVE-2026-40112 Disclosed by CISA
CISA Advisory ICSA-26-274-05 details a critical authentication bypass flaw in Johnson Controls EasyIO Neo EC and CW series building automation controllers.
Mei-Lin Chen6 Oct 20268 min read
ThreatsIndustrial & OTCritical
Johnson Controls EasyIO FS32 Automation Servers Vulnerable to Unauthenticated OS Command Injection (CVE-2026-71452)
A critical OS command injection vulnerability in Johnson Controls EasyIO FS32 controllers allows network attackers to gain root access and hijack HVAC control logic.
Daniel Okafor2 Oct 20269 min read
ThreatsIndustrial & OTHigh
Johnson Controls EasyIO Neo Edge Controllers Vulnerable to Cleartext Credential Interception and Data Disclosure (CVE-2026-64892)
CISA advisories ICSA-26-274-04 and ICSA-26-274-05 warn of cleartext credential and session disclosure in Johnson Controls EasyIO Neo building controllers.
CST Editorial Desk2 Oct 20268 min read
ThreatsIndustrial & OTHigh
Johnson Controls Simplex Incident Manager Cleartext Memory Defect Exposes Facility Credentials CVE-2026-27875
CISA Advisory ICSA-26-232-01 warns of a high-severity cleartext credential storage flaw in Johnson Controls Simplex Incident Manager fire safety software.
Mei-Lin Chen27 Sep 20268 min read
ThreatsIndustrial & OTHigh
Johnson Controls Metasys Building Automation Flaw Enables Administrative Session Hijacking CVE-2026-34491
CISA ICS Advisory ICSA-26-225-14 warns of a high-severity stored XSS defect in Johnson Controls Metasys building automation systems risking administrative takeover.
Mei-Lin Chen27 Sep 20268 min read
ThreatsIndustrial & OTCritical
Johnson Controls C-CURE 9000 Vulnerabilities Allow Attackers to Hijack Physical Facility Access Gateways
Johnson Controls and CISA release emergency advisory ICSA-26-204-01 for C-CURE 9000 and victor application servers resolving critical code execution flaw CVE-2026-21655.
Mei-Lin Chen19 Sep 202613 min read

Latest coverage

Johnson Controls EasyIO Neo Controllers Authentication Bypass Flaw CVE-2026-40112 Disclosed by CISA

Johnson Controls EasyIO FS32 Automation Servers Vulnerable to Unauthenticated OS Command Injection (CVE-2026-71452)

Johnson Controls EasyIO Neo Edge Controllers Vulnerable to Cleartext Credential Interception and Data Disclosure (CVE-2026-64892)

Johnson Controls Simplex Incident Manager Cleartext Memory Defect Exposes Facility Credentials CVE-2026-27875

Johnson Controls Metasys Building Automation Flaw Enables Administrative Session Hijacking CVE-2026-34491

Johnson Controls C-CURE 9000 Vulnerabilities Allow Attackers to Hijack Physical Facility Access Gateways