---
id: "CVE-2026-106020"
page: "https://infrastack.ai/live/CVE-2026-106020"
kind: "vulnerability"
aliases: ["CVE-2026-106020"]
title: "Johnson Controls EasyIO Neo IO Manager: LLM prompt input flaw enables search order hijacking"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "EasyIO Neo IO Manager and Tools Installer", "fixed": ["2.0", "Tools-Installer 2.0.0.0"], "affected": "1.1.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["building-automation", "easyio", "johnson-controls", "other", "windows"]
not_affected_if: []
published_at: "2026-11-06T15:17:05+00:00"
first_seen_at: "2026-11-06T15:42:43+00:00"
updated_at: "2026-11-06T15:46:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106020", "first_seen_at": "2026-11-06T15:42:43+00:00"}, {"source": "analyst", "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories", "first_seen_at": "2026-11-06T15:46:19+00:00", "cites": ["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories", "https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/"]}]
exploit_sources: []
---

# Johnson Controls EasyIO Neo IO Manager: LLM prompt input flaw enables search order hijacking

Link for people: https://infrastack.ai/live/CVE-2026-106020 (this .md is for agents)

Johnson Controls JCI-PSA-2026-15 lists EasyIO Neo IO Manager and Tools Installer 1.1.0.0 as affected by an uncontrolled library search path (search order hijacking). NVD attributes it to improper neutralization of LLM prompt input. CVSS 4.0 vector is local, high privileges, user interaction. Fix reported: IO Manager 2.0 / Tools-Installer 2.0.0.0. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EasyIO Neo IO Manager and Tools Installer affected 1.1.0.0 fixed 2.0, Tools-Installer 2.0.0.0

## How to check

Check the installed EasyIO Neo IO Manager / Tools Installer version; 1.1.0.0 is the affected version. Per the vendor, its uninstall steps refer to 1.0.0.0, so confirm the procedure with Johnson Controls. Also restrict write access to directories the tools load libraries from.

## Fix

Upgrade to IO Manager 2.0 and Tools-Installer 2.0.0.0 (per Viakoo summary of JCI-PSA-2026-15; confirm in the vendor advisory)

## Timeline

- 2026-11-06T15:42:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106020
- 2026-11-06T15:46:19+00:00 analyst https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories — Vendor index page confirms JCI-PSA-2026-15 (Nov 3 2026, with CVE-2026-106022, CVE-2026-64894). I could not open the advisory PDF itself. Fix and affected version come from a Viakoo OT news rewrite, so nothing is marked verified. LLM feature default state not found. No exploitation reported.

## Documents

- [describes] Johnson Controls Product Security Advisories (lists JCI-PSA-2026-45, CVE-2026-106019) https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
- [mentions] Daily OT Security News: November 05, 2026 (Viakoo) https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/

## From the sources

Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.

This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_