Johnson Controls vulnerabilities
113 CVEs and advisories name Johnson Controls as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-106019Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating…
- CVE-2026-64894Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows…
- CVE-2026-106022Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows…
- CVE-2026-106020Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows…
- CVE-2026-71450Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows…
- CVE-2026-71456Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.
- CVE-2026-71455Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded…
- CVE-2026-34499Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.
- CVE-2026-34498L4L
- CVE-2026-27873- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying.
- CVE-2026-64893- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack.
- CVE-2026-64892- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations.
- CVE-2026-34494- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations.
- CVE-2026-34493- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations.
- CVE-2026-71449: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data.
- CVE-2026-71448: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse.
- CVE-2026-71453- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack.
- CVE-2026-71452- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection.
- CVE-2026-71451- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection.
- CVE-2026-27874: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials.
- CVE-2026-27872EasyIO FG
- CVE-2026-64896T2000 open debug port
- CVE-2026-34491Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnso
- CVE-2026-27875Simplex Incident Manager Clear Test
- CVE-2026-34492Airwall - Arbitrary file read
- CVE-2026-64887Airwall - Hardcoded Secrets
- CVE-2026-27871TL280
- CVE-2026-34497FMS Employee Vulnerable to HTML Injection
- CVE-2026-34495FMS Employee vulnerable to XSS
- CVE-2026-21662FMS Employee Allows Upload of Unrestricted Files