Serial number: AV26-1090 Date: October 27, 2026 As of October 26, 2026, Johnson Controls is affected by vulnerabilities in the following product: Kantech Entrapass Prior to 9.20 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Johnson Controls has confirmed two vulnerabilities impacting Kantech Entrapass (PDF) Johnson Controls Product Security Advisories
Serial number: AV26-1052 Date: October 15, 2026 As of October 7, 2026, Johnson Controls is affected by a vulnerability in the following product: ADVMS Prior to 3.10 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerability impacting American Dynamics VMS - JCI-PSA-2026-17 Johnson Controls Product Security Advisories
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-8065, CVE-2026-8066, CVE-2026-8067, CVE-2010-2965, CVE-2014-9195, CVE-2023-46143, CVE-2024-8176, CVE-2025-59375, CVE-2026-34197, CVE-2026-7395, CVE-2026-11796, CVE-2026-15340, CVE-2026-27872, CVE-2026-27873, Summary: CISA has released six Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits…
Serial number: AV26-1010 Date: October 7, 2026 As of October 6, 2026, Johnson Controls is affected by a vulnerability in the following product: Illustra Standard - L4L China Prior to 6.0.0.66394 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerability impacting Illustra Standard - L4L China Johnson Controls - Product Security Advisories
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. The following versions of Johnson Controls EasyIO FG are affected: EasyIO FG firmware <=2.0b52 (CVE-2026-27872, CVE-2026-27873) CVSS Vendor Equipment v3 7.7 Johnson Controls EasyIO FG firmware 2 Vulnerabilities Use of Hard-coded Credentials, Improper Privilege Management Background Critical Infrastructure Sectors: Critical Manufacturing, Commercial…
Serial number: AV26-991 Date: October 2, 2026 As of October 1, 2026, Johnson Controls is affected by vulnerabilities in the following products: Easy IO FG Prior to 2.0b52 Easy IO Neo Prior to 3.3b63 Prior to 3.3b25 EasyIO FS32 Prior to 3.0b63 Prior to 3.3b63 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Johnson Controls - Product Security Advisories
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64893) EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b24 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64893)…
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further attacks against the system. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64892) EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64892) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64892) EasyIO Neo Series CW Controllers…
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 5.3, CVEs: CVE-2026-27875, Summary: CISA released one Industrial Control Systems (ICS) Advisory. This advisory provides timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-26-232-01 Johnson Controls Simplex Incident Manager
Serial Number: AV26-837Date: August 19, 2026 As of August 13, 2026, Johnson Controls is affected by vulnerabilities in the following products: Airwall Prior to 4.1.0 Metasys 12 all versions Metasys 13 all versions Metasys 14 all versions prior to v14.1.5 Metasys 15 all versions prior to v15.0.1 TL280 Prior to v5.62 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Johnson Controls - Product Security…
View CSAF Summary Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and unauthorized access. The following versions of Johnson Controls Metasys are affected: Metasys 12 vers:all/* (CVE-2026-34491) Metasys 13 vers:all/* (CVE-2026-34491) Metasys 14 Metasys 15 CVSS Vendor…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining unauthorized access to read arbitrary files on the system, or gain unauthorized access to protected system resources. The following versions of Johnson Controls Inc. Airwall are affected: Airwall <=4.0.4 (CVE-2026-64887, CVE-2026-34492) CVSS Vendor Equipment Vulnerabilities v3 6.8 Johnson Controls Inc. Johnson Controls Inc. Airwall Use of…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server (Update A) are affected: C-CURE 9000 <=v3.10.1 (CVE-2026-21655) victor Application Server <=v4.10 (CVE-2026-21655) victor <=v7.0 (CVE-2026-21655) victor Web victor Web <=v7.1 (CVE-2026-34496) CVSS Vendor Equipment Vulnerabilities v3 9.6 Johnson Controls Johnson…
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. The following versions of Johnson Controls Inc. TL280 are affected: TL280 <5.63 (CVE-2026-27871) CVSS Vendor Equipment Vulnerabilities v3 4.1 Johnson Controls Inc. Johnson Controls Inc. TL280 Use of a Broken or Risky Cryptographic Algorithm Background Critical Infrastructure Sectors: Critical Manufacturing, Commercial Facilities, Government Services and…