Johnson Controls vulnerabilities

Products

• Easyio Fs32 7
• Exacqvision 6
• Frick Controls Quantum Hd 6
• Metasys Ads/adx/oas Server 6
• American Dynamics Illustra Essentials Gen 4 4
• Istar Configuration Utility (icu) 4
• Metasys 4
• Exacqvision Web Service 3
• Fm Systems Employee 3
• Iq Panels2, 2+, Iqhub, Iqpanel 4, Powerg 3
• Airwall 2
• Easyio Neo Iomanager And Tools Installer 2
• Istar Ultra G2, Istar Ultra G2 Se, Istar Edge G2 2
• Istar Ultra, Istar Ultra Se 2
• Kantech Entrapass 2
• Metasys Versions Prior To 9.0 2
• Openblue Enterprise Manager Data Collector 2
• Software House C•cure 9000 2
• System Configuration Tool (sct) 2

Newest

• johnson controls c-cure 9000, victor Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000,... CVE-2026-106019 8.8 HighNovember 6, 2026
• johnson controls easyio neo iomanager and tools installer Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO... CVE-2026-64894 7.3 HighNovember 6, 2026
• johnson controls easyio neo iomanager and tools installer Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo... CVE-2026-106022 8.6 HighNovember 6, 2026
• johnson controls easyio neo io manager and tools installer Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO... CVE-2026-106020 8.6 HighNovember 6, 2026
• johnson controls easyio neo ec and cw edge controller Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO... CVE-2026-71450 8.7 HighNovember 2, 2026
• johnson controls kantech entrapass Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows... CVE-2026-71456 8.5 HighOctober 26, 2026
• johnson controls kantech entrapass Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech... CVE-2026-71455 5.3 MediumOctober 26, 2026
• johnson controls advms Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive... CVE-2026-34499 8.5 HighOctober 7, 2026
• johnson controls illustra standard - l4l china L4L CVE-2026-34498 5.1 MediumOctober 6, 2026
• johnson controls easyio fg - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword... CVE-2026-27873 5.6 MediumOctober 1, 2026
• johnson controls easyio neo - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO... CVE-2026-64893 7.3 HighOctober 1, 2026
• johnson controls easy io neo - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect... CVE-2026-64892 6.3 MediumOctober 1, 2026
• johnson controls neo series mvp2 - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data... CVE-2026-34494 7.2 HighOctober 1, 2026
• johnson controls easyio fs32 - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from... CVE-2026-34493 7.2 HighOctober 1, 2026
• johnson controls easyio fs32 : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows :... CVE-2026-71449 9.3 CriticalOctober 1, 2026
• johnson controls easyio fs32 : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32... CVE-2026-71448 5.6 MediumOctober 1, 2026
• johnson controls easyio fs32 - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows -... CVE-2026-71453 5.6 MediumOctober 1, 2026
• johnson controls easyio fs32 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection.... CVE-2026-71452 7.2 HighOctober 1, 2026
• johnson controls easyio fs32 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. ... CVE-2026-71451 5.6 MediumOctober 1, 2026
• johnson controls easyio fs32 : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows :... CVE-2026-27874 5.0 MediumOctober 1, 2026
• johnson controls easy io fg EasyIO FG CVE-2026-27872 5.6 MediumOctober 1, 2026
• johnson controls t2000 T2000 open debug port CVE-2026-64896 5.2 MediumAugust 27, 2026
• johnson controls metasys 14, metasys 15 +1 more Improper neutralization of input during web page generation ('cross-site scripting')... CVE-2026-34491 6.1 MediumAugust 24, 2026
• johnson controls simplex incident manager / autocall fire administrator Simplex Incident Manager Clear Test CVE-2026-27875 6.9 MediumAugust 21, 2026
• johnson controls airwall Airwall - Arbitrary file read CVE-2026-34492 7.0 HighAugust 14, 2026
• johnson controls airwall Airwall - Hardcoded Secrets CVE-2026-64887 7.0 HighAugust 14, 2026
• johnson controls tl280 TL280 CVE-2026-27871 2.9 LowAugust 14, 2026
• johnson controls fm systems employee, johnsoncontrols fms employee +1 more FMS Employee Vulnerable to HTML Injection CVE-2026-34497 4.8 MediumJuly 31, 2026
• johnson controls fm systems employee, johnsoncontrols fms employee +1 more FMS Employee vulnerable to XSS CVE-2026-34495 4.8 MediumJuly 31, 2026
• johnson controls fm systems employee, johnsoncontrols fms employee +1 more FMS Employee Allows Upload of Unrestricted Files CVE-2026-21662 4.8 MediumJuly 31, 2026
• johnson controls xaap application, johnsoncontrols xaap +1 more XAAP Android Data Stored in Unencrypted Database CVE-2026-34490 4.8 MediumJuly 31, 2026
• johnson controls victor web victor Web - Priviledge Escalation CVE-2026-34496 7.1 HighJuly 23, 2026
• johnson controls ccure 9000 and victor application server CCure and Victor Application Server - Server Side Request Forgery CVE-2026-21653 7.2 HighJuly 23, 2026
• johnson control victor, johnson controls ccure 9000, victor application server +2 more C-CURE 9000 and Victor application server - Deserialization of Untrusted Data CVE-2026-21655 8.7 HighJuly 23, 2026
• johnson controls ac2000 AC2000 Uncontrolled Search Path Element CVE-2026-21661 8.4 HighMay 6, 2026
• johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 more Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware CVE-2026-21660 6.9 MediumFebruary 27, 2026
• johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 more Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion CVE-2026-21659 8.7 HighFebruary 27, 2026
• johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 more Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution CVE-2026-21658 8.8 HighFebruary 27, 2026
• johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 more Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution CVE-2026-21657 8.8 HighFebruary 27, 2026
• johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 more Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution CVE-2026-21656 8.8 HighFebruary 27, 2026
• johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 more Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution CVE-2026-21654 8.8 HighFebruary 27, 2026
• johnson controls metasys Metasys product command injection vulnerability could allow remote SQL execution CVE-2025-26385 9.5 CriticalJanuary 30, 2026
• johnson controls istar configuration utility (icu) Stack-based Buffer Overflow in Johnson Controls iSTAR Configuration Utility (ICU) tool CVE-2025-26386 7.1 HighJanuary 28, 2026
• johnson controls istar ultra g2, istar ultra g2 se, istar edge g2, istar ultra, istar ultra se +1 more iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings CVE-2025-43876 8.7 HighDecember 24, 2025
• johnson controls istar ultra g2, istar ultra g2 se, istar edge g2, istar ultra, istar ultra se +1 more iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo CVE-2025-43875 8.7 HighDecember 24, 2025
• johnson controls iq panels2, 2+, iqhub, iqpanel 4, powerg Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error CVE-2025-61740 7.2 HighDecember 22, 2025
• johnson controls iq panels2, 2+, iqhub, iqpanel 4, powerg Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG use of Cryptographically Weak Pseudo-Random Number Generator CVE-2025-26379 7.2 HighDecember 22, 2025
• johnson controls iq panels2, 2+, iqhub, iqpanel 4, powerg Johnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG reusing a nonce, key pair in encryption CVE-2025-61739 7.2 HighDecember 22, 2025
• johnson controls iqpanel2, iqhub,iqpanel2+,iqpanel 4,powerg Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information CVE-2025-61738 2.3 LowDecember 22, 2025
• johnson controls openblue workplace (formerly fm systems) OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems) CVE-2025-26381 6.5 MediumDecember 17, 2025
• Show olderLoading…