Johnson Controls EasyIO Neo Controllers Expose Data via CVE-2026-64892

Key points

• CVE-2026-64892 affects Johnson Controls EasyIO Neo EC and CW controllers.
• Exploitation can leak sensitive information and enable further intrusions.
• The issue has a global reach, touching critical infrastructure sectors.
• Patch status is not specified in the available facts.

Johnson Controls manufactures EasyIO Neo EC and CW controllers, which are widely used in building automation and industrial control systems. A security flaw tracked as CVE-2026-64892 has been identified in these devices. The vulnerability is rated medium severity.

An attacker could take advantage of this bug to reach confidential data. After gaining that access, the intruder might use it to initiate further attacks. The primary consequence is the leak of sensitive information, but the potential for follow-on activity is just as troubling. Such a sequence could allow the adversary to move laterally or establish persistence within the network.

These controllers are deployed across the globe. They are often found in critical infrastructure environments, including energy, water, and transportation. This wide distribution means the flaw's impact is not confined to one country or industry.

For administrators, the danger is dual: direct data loss and a launchpad for more harmful operations. Because these devices often bridge IT and operational technology networks, a compromise can weaken both cyber and physical defenses.

To stay ahead, watch for advisories from Johnson Controls regarding patches or workarounds. Keep an eye on CVE-2026-64892 for reports of active exploitation. Review how your EasyIO Neo controllers are segmented and who can reach them. Ensure that remote access is limited and that default credentials are changed.

What to do now

1. Inventory all EasyIO Neo EC and CW controllers in your environment.
2. Immediately isolate these devices from public networks and restrict inbound/outbound traffic.
3. Apply firmware updates or mitigations from Johnson Controls as soon as they are released.
4. Enforce strong authentication and change default passwords on all affected controllers.
5. Monitor network logs for anomalous access or data exfiltration tied to CVE-2026-64892.
6. Prepare an incident response plan that accounts for follow-on attacks and lateral movement.

CVE references

• CVE-2026-64892

Original source

CISA Advisories