# Johnson Controls vulnerabilities Source: https://junglewise.ai/threats/vendors/johnson-controls Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 22:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/johnson-controls.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 35 vulnerabilities in Johnson Controls: 5 in the last 7 days and 24 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-106018, was published on 12 November 2026. 7 vulnerabilities in the last four weeks, down 46% on the four before (13). 3 technologies have a page of their own. ## Counts - Last 7 days: 5 - Last 30 days: 8 - Last 90 days: 24 - All time: 35 (0 critical, 0 exploited in the wild) ## About Johnson Controls A multinational conglomerate that produces fire, HVAC, and security equipment for buildings. ## Latest Johnson Controls vulnerabilities - [CVE-2026-106018: Johnson Controls EasyIO authentication bypass via alternate path](https://junglewise.ai/threats/cve-2026-106018-authentication-bypass-using-an-alternate-path-or-channel) (info, published 12 Nov 2026) - [CVE-2026-64894: Johnson Controls EasyIO Neo IOManager inclusion of untrusted functionality](https://junglewise.ai/threats/cve-2026-64894-inclusion-of-functionality-from-untrusted-control-sphere) (info, published 6 Nov 2026) - [CVE-2026-106022: Johnson Controls EasyIO Neo cleartext storage of sensitive information in memory](https://junglewise.ai/threats/cve-2026-106022-cleartext-storage-of-sensitive-information-in-memory) (info, published 6 Nov 2026) - [CVE-2026-106020: Johnson Controls EasyIO Neo IO Manager prompt injection vulnerability](https://junglewise.ai/threats/cve-2026-106020-improper-neutralization-of-input-used-for-llm-prompting) (info, published 6 Nov 2026) - [CVE-2026-106019: Johnson Controls C-CURE 9000 Victor sensitive information in log file](https://junglewise.ai/threats/cve-2026-106019-insertion-of-sensitive-information-into-log-file-vulnerability) (info, published 6 Nov 2026) - [CVE-2026-71450: Johnson Controls EasyIO Neo EC and CW Edge Controller auth bypass](https://junglewise.ai/threats/cve-2026-71450-authentication-bypass-using-an-alternate-path-or-channel) (info, published 2 Nov 2026) - [CVE-2026-71456: Johnson Controls Kantech Entrapass hard-coded cryptographic key](https://junglewise.ai/threats/cve-2026-71456-use-of-hard-coded-cryptographic-key-vulnerability-in-johnson) (info, published 26 Oct 2026) - [CVE-2026-71455: Johnson Controls Kantech Entrapass cleartext storage of sensitive data in memory](https://junglewise.ai/threats/cve-2026-71455-cleartext-storage-of-sensitive-information-in-memory) (info, published 26 Oct 2026) - [CVE-2026-34498: Johnson Controls Illustra Standard OS command injection via improper input validation](https://junglewise.ai/threats/cve-2026-34498-improper-input-validation-vulnerability-in-johnson-controls) (info, published 6 Oct 2026) - [CVE-2026-71453: Johnson Controls EasyIO FS32 path traversal](https://junglewise.ai/threats/cve-2026-71453-external-control-of-file-name-or-path-vulnerability-in-johnson) (info, published 1 Oct 2026) - [CVE-2026-71452: Johnson Controls EasyIO FS32 OS command injection](https://junglewise.ai/threats/cve-2026-71452-os-command-injection-vulnerability-in-johnson-controls-easyio) (info, published 1 Oct 2026) - [CVE-2026-71449: Johnson Controls EasyIO FS32 hardcoded cryptographic key](https://junglewise.ai/threats/cve-2026-71449-use-of-hard-coded-cryptographic-key-vulnerability-in-johnson) (info, published 1 Oct 2026) - [CVE-2026-71448: Johnson Controls EasyIO FS32 insecure default initialization authentication abuse](https://junglewise.ai/threats/cve-2026-71448-insecure-default-initialization-of-resource-vulnerability-in) (info, published 1 Oct 2026) - [CVE-2026-64893: Johnson Controls EasyIO Neo Series EC and CW Controllers cleartext transmission](https://junglewise.ai/threats/cve-2026-64893-johnson-controls-easyio-neo-series-ec-and-cw-controllers) (high, published 1 Oct 2026) - [CVE-2026-64892: Johnson Controls EasyIO Neo Series EC and CW Controllers information disclosure](https://junglewise.ai/threats/cve-2026-64892-johnson-controls-easyio-neo-series-ec-and-cw-controllers) (high, published 1 Oct 2026) - [CVE-2026-34494: Johnson Controls Neo Series MVP2 on-chip debug interface information disclosure](https://junglewise.ai/threats/cve-2026-34494-on-chip-debug-interface-vulnerability-in-johnson-controls-neo) (info, published 1 Oct 2026) - [CVE-2026-34493: Johnson Controls EasyIO FS32 debug interface information exposure](https://junglewise.ai/threats/cve-2026-34493-on-chip-debug-interface-vulnerability-in-johnson-controls-easyio) (info, published 1 Oct 2026) - [CVE-2026-27873: Johnson Controls EasyIO FG hard-coded credentials in password spraying](https://junglewise.ai/threats/cve-2026-27873-use-of-hard-coded-credentials-vulnerability-in-johnson-controls) (info, published 1 Oct 2026) - [CVE-2026-71451: Johnson Controls EasyIO FS32 OS command injection](https://junglewise.ai/threats/cve-2026-71451-os-command-injection-vulnerability-in-johnson-controls-easyio) (info, published 1 Oct 2026) - [CVE-2026-27874: Johnson Controls EasyIO FS32 hard-coded credentials](https://junglewise.ai/threats/cve-2026-27874-use-of-hard-coded-credentials-vulnerability-in-johnson-controls) (info, published 1 Oct 2026) - [CVE-2026-27872: Johnson Controls Easy IO FG improper privilege management](https://junglewise.ai/threats/cve-2026-27872-improper-privilege-management-vulnerability-in-johnson-controls) (high, published 1 Oct 2026) - [CVE-2026-64896: Johnson Controls T2000 improper access control in debug interface](https://junglewise.ai/threats/cve-2026-64896-johnson-controls-t2000-improper-access-control-in-debug-interface) (info, published 27 Aug 2026) - [CVE-2026-34491: Johnson Controls Metasys cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-34491-johnson-controls-metasys-cross-site-scripting-vulnerability) (info, published 24 Aug 2026) - [CVE-2026-27875: Johnson Controls Simplex Incident Manager cleartext storage of sensitive information](https://junglewise.ai/threats/cve-2026-27875-johnson-controls-simplex-incident-manager-cleartext-storage-of) (info, published 21 Aug 2026) - [CVE-2026-64887: Johnson Controls Airwall hard-coded cryptographic key](https://junglewise.ai/threats/cve-2026-64887-johnson-controls-airwall-hard-coded-cryptographic-key) (info, published 14 Aug 2026) ## Most severe Johnson Controls vulnerabilities - [CVE-2026-21661: Johnson Controls CEM AC2000 privilege escalation via DLL hijacking](https://junglewise.ai/threats/cve-2026-21661-johnson-controls-cem-ac2000) (high, CVSS 8.7, published 6 May 2026) - [CVE-2026-64892: Johnson Controls EasyIO Neo Series EC and CW Controllers information disclosure](https://junglewise.ai/threats/cve-2026-64892-johnson-controls-easyio-neo-series-ec-and-cw-controllers) (high, published 1 Oct 2026) - [CVE-2026-64893: Johnson Controls EasyIO Neo Series EC and CW Controllers cleartext transmission](https://junglewise.ai/threats/cve-2026-64893-johnson-controls-easyio-neo-series-ec-and-cw-controllers) (high, published 1 Oct 2026) - [CVE-2026-27872: Johnson Controls Easy IO FG improper privilege management](https://junglewise.ai/threats/cve-2026-27872-improper-privilege-management-vulnerability-in-johnson-controls) (high, published 1 Oct 2026) - [CVE-2026-21655: Johnson Controls victor Deserialization of Untrusted Data on Windows](https://junglewise.ai/threats/cve-2026-21655-johnson-controls-victor-deserialization-of-untrusted-data-on) (info, CVSS 8.7, published 23 Jul 2026) - [CVE-2026-21653: Johnson Controls CCure 9000 and victor SSRF in Victor component](https://junglewise.ai/threats/cve-2026-21653-johnson-controls-ccure-9000-and-victor-ssrf-in-victor-component) (info, CVSS 7.2, published 23 Jul 2026) - [CVE-2026-34496: Johnson Controls victor Web privilege escalation on Windows](https://junglewise.ai/threats/cve-2026-34496-johnson-controls-victor-web-privilege-escalation-on-windows) (info, CVSS 7.1, published 23 Jul 2026) - [CVE-2026-34497: Johnson Controls FM Systems Employee Cross-Site Scripting](https://junglewise.ai/threats/cve-2026-34497-johnson-controls-fm-systems-employee-cross-site-scripting) (info, CVSS 4.8, published 31 Jul 2026) - [CVE-2026-34495: Johnson Controls FM Systems Employee Stored XSS](https://junglewise.ai/threats/cve-2026-34495-johnson-controls-fm-systems-employee-stored-xss) (info, CVSS 4.8, published 31 Jul 2026) - [CVE-2026-34490: Johnson Controls XAAP Application cleartext storage on Android](https://junglewise.ai/threats/cve-2026-34490-johnson-controls-xaap-application-cleartext-storage-on-android) (info, CVSS 4.8, published 31 Jul 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, down 46% on the four before (13). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 12 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 5 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Johnson Controls technologies - [Johnson Controls EasyIO FS32](https://junglewise.ai/threats/technologies/easyio-fs32): 7 vulnerabilities - [Johnson Controls EasyIO Neo Tools Installer](https://junglewise.ai/threats/technologies/easyio-neo-tools-installer): 3 vulnerabilities - [Johnson Controls FM Systems Employee](https://junglewise.ai/threats/technologies/fm-systems-employee): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Johnson Controls vulnerabilities", https://junglewise.ai/threats/vendors/johnson-controls, 12 November 2026.