Is CVE-2026-27873 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27873 being exploited in the wild.

How severe is CVE-2026-27873?

High severity, published 1 October 2026.

Which products and versions are affected?

Johnson Controls Easy IO FG before 2.0b52.

Is there a fix for CVE-2026-27873?

Yes: fixed in Easy IO FG 2.0b52. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27873 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-27873?

Check whether you run Johnson Controls Easy IO FG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27873: Johnson Controls Easy IO FG improper privilege management

CVE-2026-27873 · Severity: high · Published 2026-10-01

Johnson Controls Easy IO FG is a building automation system component used to manage HVAC and facility controls. An improper privilege management vulnerability allows attackers to conduct brute force attacks, potentially gaining unauthorized access to facility systems and controls.

Vendors: Johnson Controls.

Quick answers

Is CVE-2026-27873 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27873 being exploited in the wild.
How severe is CVE-2026-27873?: High severity, published 1 October 2026.
Which products and versions are affected?: Johnson Controls Easy IO FG before 2.0b52.
Is there a fix for CVE-2026-27873?: Yes: fixed in Easy IO FG 2.0b52. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27873 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-27873?: Check whether you run Johnson Controls Easy IO FG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Easy IO FG 2.0b52

Technical details

The vulnerability is an improper privilege management flaw in Easy IO FG that enables brute force attacks. The exact attack vector and prerequisites are not detailed in the advisory. A fix is available in version 2.0b52 and later.

Affected products

Johnson Controls Easy IO FG before 2.0b52

Identifiers

CVE-2026-27873
CVE-2026-27872

Timeline

2026-10-01: disclosed

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.