Vulnerability record

CVE-2026-27872

ElevatedNo known exploitation

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.

- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.0b52.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Developments from the last 30 days, newest first.

CVSS scoredUpdateOct 6, 2026
CVE-2026-27872 scored CVSS 5.6
Basis: NIST National Vulnerability Database
DisclosedOct 6, 2026
Johnson Controls EasyIO FG
Basis: CISA Cybersecurity Advisories (government advisory)

ElevatedBe aware

CISA Cybersecurity Advisories7 hours agoCritical infra

johnsoncontrols.com https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories