Loading story…
The Canadian Centre for Cyber Security issued advisory AV26-991 concerning vulnerabilities affecting Johnson Controls EasyIO control-system products. The notice lists Easy IO FG versions prior to 2.0b52, Easy IO Neo versions prior to 3.3b63 and prior to 3.3b25, and EasyIO FS32 versions prior to 3.0b63 and prior to 3.3b63. The advisory was published on October 2, 2026, and covers vulnerabilities reported as of October 1.
The Cyber Centre recommends that users and administrators review Johnson Controls’ Product Security Advisories and apply necessary updates as they become available. Organizations operating these products should check installed versions against the vendor’s guidance, particularly the multiple thresholds listed for Neo and FS32. The supplied notices do not identify CVEs, technical impacts, severity ratings, or exploitation status, leaving those details to be verified through the vendor advisories.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
On October 2, 2026, the Canadian Centre for Cyber Security issued advisory AV26-991 identifying vulnerabilities affecting Johnson Controls Easy IO FG, Easy IO Neo, and EasyIO FS32 products. It recommended reviewing the vendor’s security advisories and applying necessary updates as they become available; the notice provided no CVE identifiers, technical details, severity ratings, or exploitation status.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcejohnsoncontrols.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Canadian Centre for Cyber Security issued advisory **AV26-837** warning that multiple **Johnson Controls** products are affected by security vulnerabilities. The notice identifies impacted products as **Airwall** prior to `4.1.0`, **Metasys 12**, **Metasys 13**, **Metasys 14** prior to `14.1.5`, **Metasys 15** prior to `15.0.1`, and **TL280** prior to `5.62`. The advisory does not include CVE identifiers or public exploit details in the cited material, but it frames the issue as affecting control-system-related technology used in operational environments. Authorities advised users and administrators to review Johnson Controls security bulletins and apply vendor updates as they become available. The alert was republished across security news channels and highlights potential exposure across building management and related control system deployments, with defenders urged to verify product versions and prioritize remediation for affected installations.
Aug 20, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) released seven new advisories detailing vulnerabilities affecting a range of industrial control system (ICS) products from vendors such as Güralp Systems, Johnson Controls, Hitachi Energy, Mitsubishi Electric, ICONICS, and Fuji Electric. Among these, a notable vulnerability in Mitsubishi Electric GT Designer3 (CVE-2025-11009) allows attackers to obtain plaintext credentials from project files, potentially enabling unauthorized operation of GOT2000 and GOT1000 series devices. CISA urges administrators to review the technical details and apply recommended mitigations to protect critical manufacturing and infrastructure sectors. Additional reporting from the Canadian Centre for Cyber Security highlights the same CISA advisories, emphasizing the need for organizations to address vulnerabilities in products like Johnson Controls iSTAR and others. The advisories provide actionable guidance for mitigating risks associated with these ICS vulnerabilities, underscoring the importance of timely updates and security best practices for operators of affected systems worldwide.
Jun 29, 2026
CISA released a coordinated set of advisories detailing newly discovered vulnerabilities affecting a range of industrial control system (ICS) products from vendors including Advantech, Johnson Controls, Mitsubishi Electric, and SolisCloud. The vulnerabilities include a critical SQL injection flaw in Advantech iView (CVE-2025-13373), improper certificate expiration validation in Johnson Controls iSTAR (CVE-2025-61736), cleartext storage of sensitive information in Mitsubishi Electric GX Works2 (CVE-2025-3784), a forced browsing vulnerability in Johnson Controls OpenBlue Mobile Web Application (CVE-2025-26381), and an authorization bypass in SolisCloud Monitoring Platform (CVE-2025-13932). These flaws could allow attackers to access or modify sensitive data, disrupt communications, or gain unauthorized access to critical infrastructure systems. CISA's advisories provide technical details, affected product versions, and recommended mitigations, such as software updates and network segmentation, to reduce the risk of exploitation. The vulnerabilities impact products deployed globally across sectors such as critical manufacturing, energy, commercial facilities, and government services. Some advisories note that fixes are available, while others indicate that patches are still under development or that vendors have not responded to coordination efforts. CISA urges organizations using these products to review the advisories and implement recommended mitigations to protect against potential attacks targeting these ICS environments.
Jun 29, 2026