---
id: "CVE-2026-106022"
page: "https://infrastack.ai/live/CVE-2026-106022"
kind: "vulnerability"
aliases: ["CVE-2026-106022"]
title: "Johnson Controls EasyIO Neo IOManager: cleartext secrets in memory leak sensitive data"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EasyIO Neo IOManager and Tools Installer", "fixed": ["IO Manager 2.0", "Tools-Installer 2.0.0.0"], "affected": "1.1.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["building-automation", "easyio", "infrastructure", "johnson-controls", "local-access", "windows-workstation"]
not_affected_if: []
published_at: "2026-11-06T15:17:05+00:00"
first_seen_at: "2026-11-06T15:42:43+00:00"
updated_at: "2026-11-06T15:45:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106022", "first_seen_at": "2026-11-06T15:42:43+00:00"}, {"source": "analyst", "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories", "first_seen_at": "2026-11-06T15:45:23+00:00", "cites": ["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories", "https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/"]}]
exploit_sources: []
---

# Johnson Controls EasyIO Neo IOManager: cleartext secrets in memory leak sensitive data

Link for people: https://infrastack.ai/live/CVE-2026-106022 (this .md is for agents)

EasyIO Neo IOManager and Tools Installer 1.1.0.0 keep sensitive authentication or authorization data in cleartext in process memory. A local user on the machine can extract it. CVSS 4.0 8.6 (vector AV:L, PR:L, UI:P). No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EasyIO Neo IOManager and Tools Installer affected 1.1.0.0 fixed IO Manager 2.0, Tools-Installer 2.0.0.0

## How to check

Check the installed EasyIO Neo IO Manager and Tools Installer version: 1.1.0.0 is affected. Also check commissioning workstations where it is installed and who has local accounts there.

## Fix

Upgrade to EasyIO Neo IO Manager 2.0 and Tools-Installer 2.0.0.0 (per secondary summary of the vendor advisory; not confirmed on the vendor page)

## Timeline

- 2026-11-06T15:42:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106022
- 2026-11-06T15:45:23+00:00 analyst https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories — Vendor listing (JCI-PSA-2026-15, Nov 3 2026) confirms advisory covers this CVE but I could not open the advisory PDF itself; fix IO Manager 2.0 / Tools-Installer-2.0.0.0 and local-access prerequisite come from Viakoo summary only, so nothing marked verified.

## Documents

- [describes] Johnson Controls Product Security Advisories (lists JCI-PSA-2026-45, CVE-2026-106019) https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
- [mentions] Daily OT Security News: November 05, 2026 (Viakoo) https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/

## From the sources

Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Retrieve Embedded Sensitive Data.

This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_