The Cybersecurity and Infrastructure Security Agency has warned that a vulnerability in Johnson Controls EasyIO Neo Series EC and CW controllers could expose sensitive information and give attackers material for further attacks. CISA published the advisory on October 1, 2026, identifying the issue as CVE-2026-64892 and classifying it as exposure of sensitive information to an unauthorized actor. CISA’s advisory says the affected products are used in building automation and control systems.
The affected EC controller versions are V3.3b62 and V3.3b63. The affected CW controller versions are V3.3b24 and V3.3b25. CISA lists the products as known affected and says successful exploitation could allow access to sensitive information that could be used to conduct additional attacks against the system.
Johnson Controls has released firmware intended to address the vulnerability. The fixed release for EC controllers is V3.3b64, while the fixed release for CW controllers is V3.3b26. Users are advised to upgrade to the applicable fixed version or a later release as soon as operationally feasible, with support available through a Johnson Controls representative or an authorized EasyIO distributor, CISA said.
The EC and CW products are programmable edge controllers that manage and automate building functions such as heating, ventilation and air conditioning, lighting, and energy management. They support open protocols including BACnet and Modbus, allowing connections to other systems. CISA places the products in an environment that includes commercial facilities, critical manufacturing, government services and facilities, transportation systems, and energy operations, with deployments listed worldwide.
The vulnerability carries a CVSS 3.1 base score of 3.5, rated low, and a CVSS 4.0 score of 4.8, rated medium. The published scoring indicates that exploitation is network-reachable but requires high privileges and user interaction. The CVSS 3.1 vector also assigns limited impact to confidentiality and availability, with no impact listed for integrity. CISA identifies the weakness under CWE-200, exposure of sensitive information to an unauthorized actor.
Organizations applying the firmware in operational technology or industrial control environments should first assess operational impact, back up relevant configurations, test the update outside production where feasible, and follow established change-management and safety procedures. CISA also recommends proper impact analysis and risk assessment before defensive measures are deployed.
If an immediate upgrade is not possible, Johnson Controls recommends controlling physical access to device debug ports, monitoring traffic to and from the controllers for unusual or unauthorized access attempts, and applying least privilege to accounts and services that interact with the devices. The company also recommends intrusion detection or prevention monitoring and, where possible, firmware that disables debug interfaces or requires authentication before debug access is granted. CISA says these measures can reduce risk but may not fully remediate the vulnerability.
Additional hardening instructions are available through Johnson Controls Product Security Advisory JCI-PSA-2026-20 and the company’s cybersecurity resources. CISA said no known public exploitation specifically targeting CVE-2026-64892 had been reported to the agency at the time of the advisory. Users should update to the fixed versions when operationally feasible and apply the recommended safeguards while updates are pending.
By Security Innovation Lab Analysis Desk