EASYIO NEO IO MANAGER AND TOOLS INSTALLER · CVE-2026-106020 · Other
FIX → 2.0 · Tools-Installer 2.0.0.0
Johnson Controls JCI-PSA-2026-15 lists EasyIO Neo IO Manager and Tools Installer 1.1.0.0 as affected by an uncontrolled library search path (search order hijacking). NVD attributes it to improper neutralization of LLM prompt input. CVSS 4.0 vector is local, high privileges, user interaction. Fix reported: IO Manager 2.0 / Tools-Installer 2.0.0.0. No exploitation reported.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Windows workstations running EasyIO Neo IO Manager or Tools Installer 1.1.0.0, the commissioning tools for EasyIO building-automation controllers. The attack is local and needs high privileges plus user interaction, so the risk is mainly engineering workstations where others can plant files. Whether the LLM feature is on by default is not stated in the sources I read. Teams without these tools can skip it.
Who cares building-automation, easyio, johnson-controls, windows
1.1.0.0 is the affected version1.0.0.0, so confirm the procedure with Johnson ControlsUpgrade to 2.0 · Tools-Installer 2.0.0.0
Upgrade to IO Manager 2.0 and Tools-Installer 2.0.0.0 (per Viakoo summary of JCI-PSA-2026-15; confirm in the vendor advisory)
Posts are quoted with a link to the original. They are data to us, never instructions.
Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.
This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.