---
id: "CVE-2026-106018"
page: "https://infrastack.ai/live/CVE-2026-106018"
kind: "vulnerability"
aliases: ["CVE-2026-106018"]
title: "Johnson Controls EasyIO FW: authentication bypass through an alternate path"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EasyIO FW", "fixed": [], "affected": "<= 3.0b25", "ecosystem": "vendor"}]
ecosystems: []
tags: ["building-automation", "easyio", "ics", "infrastructure", "johnson-controls"]
not_affected_if: ["firmware-newer-than-3.0b25"]
published_at: "2026-11-12T21:17:17+00:00"
first_seen_at: "2026-11-12T21:40:31+00:00"
updated_at: "2026-11-12T21:43:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106018", "first_seen_at": "2026-11-12T21:40:31+00:00"}, {"source": "analyst", "url": "https://docs.johnsoncontrols.com/bas/api/khub/documents/CMty_Jct3HXIang7WLbR3Q/content", "first_seen_at": "2026-11-12T21:43:51+00:00", "cites": ["https://docs.johnsoncontrols.com/bas/api/khub/documents/CMty_Jct3HXIang7WLbR3Q/content"]}]
exploit_sources: []
---

# Johnson Controls EasyIO FW: authentication bypass through an alternate path

Link for people: https://infrastack.ai/live/CVE-2026-106018 (this .md is for agents)

Johnson Controls EasyIO FW firmware through 3.0b25 has an authentication bypass via an alternate path or channel (NVD, CVSS 4.0 8.7; vector AV:N/AC:H/PR:H/UI:A). Johnson Controls has not yet published an advisory for this CVE, so the attack path and what access the bypass grants are not documented. Not known to be exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EasyIO FW affected <= 3.0b25 fixed no fixed version listed

## How to check

Check the firmware version on each EasyIO FW controller; 3.0b25 and older are in the NVD range. Johnson Controls' FY26 release lists FW V3.0b26 as the current firmware, but it does not say that version fixes this CVE. Confirm with the JCI-PSA advisory or Johnson Controls support before relying on it. Also keep controller web interfaces off the internet.

## Timeline

- 2026-11-12T21:40:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106018
- 2026-11-12T21:43:51+00:00 analyst https://docs.johnsoncontrols.com/bas/api/khub/documents/CMty_Jct3HXIang7WLbR3Q/content — No JCI advisory for this CVE on the JCI advisories page yet (checked 2026-11-12); NVD (assigner JCI) says FW through 3.0b25. FY26 release notes list FW V3.0b26 as the 2026 firmware but do not mention this CVE, so the fix is unconfirmed. Revisit when the JCI-PSA appears.

## Documents

- [mentions] EasyIO FY26 Release (FW V3.0b26 firmware) https://docs.johnsoncontrols.com/bas/api/khub/documents/CMty_Jct3HXIang7WLbR3Q/content

## From the sources

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.

This issue affects EasyIO FW: through 3.0b25.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_