CISA republishes the vendor advisory

CISA dated its initial republication of a Johnson Controls product security advisory October 1, 2026. The entry identifies the vendor advisory as JCI-PSA-2026-20. That date marks CISA’s republication of the advisory; it does not establish when the vulnerability was discovered or when affected software first became available.

According to CISA, successful exploitation could give an attacker access to sensitive information that could then be used for further attacks against the system. The agency describes a possible consequence of exploitation. Its warning does not say that information has actually been obtained or that a subsequent attack has occurred.

Affected versions and building functions

CISA lists four affected versions under CVE-2026-64892. For Johnson Controls EasyIO Neo Series EC Controllers, the listed versions are V3.3b63 and V3.3b62. For EasyIO Neo Series CW Controllers, they are V3.3b25 and V3.3b24. CISA describes deployment as worldwide and lists sectors including commercial facilities, manufacturing, government facilities, transportation and energy.

The advisory describes EC and CW products as programmable edge controllers for building automation and control systems. Their functions include managing heating, ventilation and air conditioning, lighting, and energy use. It also identifies BACnet and Modbus as supported open protocols for connecting systems, placing the affected equipment within the infrastructure used to operate buildings.

CISA’s exploitation statement and defensive advice

CISA says it had received no reports of known public exploitation specifically targeting this vulnerability at the time of the advisory. That statement is limited to exploitation reported to the agency; it should not be read as establishing that exploitation could not have occurred.

For users of the affected equipment, CISA recommends defensive measures to reduce exploitation risk and says the recommendations in Johnson Controls’ Hardening Guide should always be applied. It also calls for an impact analysis and risk assessment before deploying defensive measures, making assessment of the proposed changes part of its advice to organizations.

Sources & context

  1. Johnson Controls EasyIO Neo Series EC and CW Controllers | CISACISA

    Single-source report; claims attributed to the source, not independently verified. Source feed date (published): 2026-10-01T12:00:00.000Z. Study date: not established. Consulted: 2026-10-01T19:00:04.595Z.

AI assisted with preparing and checking this article. The responsible editor accepted this version for publication following an assisted review of facts, sources and attribution.

Related reading