Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 103

Export CSV
CVE-2026-64894

Inclusion of Untrusted Control Sphere Functionality Enables Malicious Software Update in Johnson Controls EasyIO Neo IOManager

Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update. This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Easyio Neo Iomanager And Tools Installer
CVE-2026-106019

C-CURE 9000 Logging Credential Disclosure Vulnerability

Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials. This issue affects C-CURE 9000, Victor: 3.20.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Johnson Control Johnsoncontrols
Products
Victor C-cure 9000 Victor
CVE-2026-106022

Cleartext Storage of Sensitive Information in EasyIO Neo IOManager Memory

Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Retrieve Embedded Sensitive Data. This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Easyio Neo Iomanager And Tools Installer
CVE-2026-106020

LLM Prompting Input Neutralization Failure Leading to Search Order Hijacking

Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking. This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Easyio Neo Io Manager And Tools Installer
CVE-2026-71450

Authentication bypass via alternate path in EasyIO Neo EC and CW Edge Controller

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Easyio Neo Ec And Cw Edge Controller
CVE-2026-71456

Hard‑coded Cryptographic Key Enables Padding Oracle Attack in Kantech Entrapass

Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Kantech Entrapass
CVE-2026-71455

Cleartext Sensitive Data Stored in Memory Exposure

Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive Data. This issue affects Kantech Entrapass: before 9.20.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Kantech Entrapass
CVE-2026-34499

Hard-Coded Cryptographic Key Exposed in Johnson Controls ADVMS

Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Advms
CVE-2018-10624

Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information

In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Bcpro Metasys System
CVE-2026-34491

Cross‑Site Scripting Vulnerability in Johnson Controls Metasys 14 and 15

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Johnson Controls Johnsoncontrols
Products
Metasys 14 Metasys 15 Metasys
CVE-2026-21661

AC2000 Uncontrolled Search Path Element

An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Johnson Controls Johnsoncontrols
Products
Ac2000 Ac2000
CVE-2026-21660

Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Frick Controls Quantum Hd Frick Controls Quantum Hd Firmware
CVE-2026-27875

Simplex Incident Manager Clear Test

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Johnson Controls Johnsoncontrols
Products
Simplex Incident Manager Autocall Fire Administrator Simplex Incident Manager / Autocall Fire Administrator
CVE-2026-21655

C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Johnson Control Johnson Controls Johnsoncontrols
Products
Victor Ccure 9000 Victor Application Server and 1 more
CVE-2026-34490

XAAP Android Data Stored in Unencrypted Database

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Johnson Controls Johnsoncontrols
Products
Xaap Application Xaap Xaap Application