Loading story…
The Canadian Centre for Cyber Security issued advisory AV26-837 warning that multiple Johnson Controls products are affected by security vulnerabilities. The notice identifies impacted products as Airwall prior to 4.1.0, Metasys 12, Metasys 13, Metasys 14 prior to 14.1.5, Metasys 15 prior to 15.0.1, and TL280 prior to 5.62. The advisory does not include CVE identifiers or public exploit details in the cited material, but it frames the issue as affecting control-system-related technology used in operational environments.
Authorities advised users and administrators to review Johnson Controls security bulletins and apply vendor updates as they become available. The alert was republished across security news channels and highlights potential exposure across building management and related control system deployments, with defenders urged to verify product versions and prioritize remediation for affected installations.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On August 19, 2026, the Canadian Centre for Cyber Security issued advisory AV26-837 covering vulnerabilities affecting several Johnson Controls products. The notice directed users and administrators to review Johnson Controls security advisories and apply updates when available.
As of August 13, 2026, Johnson Controls reported vulnerabilities affecting multiple products, including Airwall, Metasys 12, Metasys 13, Metasys 14 prior to 14.1.5, Metasys 15 prior to 15.0.1, and TL280. One reference further specifies affected versions as Airwall prior to 4.1.0 and TL280 prior to 5.62.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcesiberguvenlik.gov.tr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Canadian Centre for Cyber Security issued advisory **AV26-991** concerning vulnerabilities affecting Johnson Controls EasyIO control-system products. The notice lists Easy IO FG versions prior to 2.0b52, Easy IO Neo versions prior to 3.3b63 and prior to 3.3b25, and EasyIO FS32 versions prior to 3.0b63 and prior to 3.3b63. The advisory was published on October 2, 2026, and covers vulnerabilities reported as of October 1. The Cyber Centre recommends that users and administrators review Johnson Controls’ **Product Security Advisories** and apply necessary updates as they become available. Organizations operating these products should check installed versions against the vendor’s guidance, particularly the multiple thresholds listed for Neo and FS32. The supplied notices do not identify CVEs, technical impacts, severity ratings, or exploitation status, leaving those details to be verified through the vendor advisories.
Oct 2, 2026
Palo Alto Networks Unit 42 reported **CVE-2025-0921**, a **medium-severity (CVSS 6.5)** vulnerability in *Mitsubishi Electric Iconics Digital Solutions GENESIS64 (Iconics Suite)* affecting Windows deployments **10.97.2 and earlier**. The issue involves **unnecessary privileges** across multiple services, enabling misuse of privileged file system operations that could **corrupt critical binaries** and lead to **integrity/availability impact**, including a potential **denial-of-service (DoS)** condition; Unit 42 coordinated disclosure with Iconics, and the vendor published mitigations/workarounds intended to address the reported issues. Separately, reporting highlighted a CISA warning on **CVE-2025-26385**, a **critical (CVSS 10.0)** vulnerability in *Johnson Controls Metasys* building automation components (including **ADS/ADX**, **SCT**, **CCT**, and certain **NAE/LCS engines** across specified version ranges). The flaw is described as a **remote SQL injection / remote SQL execution** condition that could allow unauthorized SQL command execution, potentially enabling **alteration or loss of data** used to manage building environments; Johnson Controls and CISA recommended applying the vendor patch (e.g., **GIV-165989** via the License Portal) and following compensating controls where patching is not immediately possible.
Jun 29, 2026
CISA released a coordinated set of advisories detailing newly discovered vulnerabilities affecting a range of industrial control system (ICS) products from vendors including Advantech, Johnson Controls, Mitsubishi Electric, and SolisCloud. The vulnerabilities include a critical SQL injection flaw in Advantech iView (CVE-2025-13373), improper certificate expiration validation in Johnson Controls iSTAR (CVE-2025-61736), cleartext storage of sensitive information in Mitsubishi Electric GX Works2 (CVE-2025-3784), a forced browsing vulnerability in Johnson Controls OpenBlue Mobile Web Application (CVE-2025-26381), and an authorization bypass in SolisCloud Monitoring Platform (CVE-2025-13932). These flaws could allow attackers to access or modify sensitive data, disrupt communications, or gain unauthorized access to critical infrastructure systems. CISA's advisories provide technical details, affected product versions, and recommended mitigations, such as software updates and network segmentation, to reduce the risk of exploitation. The vulnerabilities impact products deployed globally across sectors such as critical manufacturing, energy, commercial facilities, and government services. Some advisories note that fixes are available, while others indicate that patches are still under development or that vendors have not responded to coordination efforts. CISA urges organizations using these products to review the advisories and implement recommended mitigations to protect against potential attacks targeting these ICS environments.
Jun 29, 2026