EASYIO NEO IOMANAGER AND TOOLS INSTALLER · CVE-2026-64894 · Infrastructure
FIX → IO Manager 2.0 +1
NVD and Johnson Controls (JCI-PSA-2026-15) list EasyIO Neo IOManager and Tools Installer 1.1.0.0 as affected by a malicious software update flaw. A secondary summary describes it as replacement of unsigned binaries or libraries. The CVSS 4.0 vector is physical access, high complexity, with user interaction. No exploitation is reported.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running EasyIO Neo IO Manager / Tools Installer 1.1.0.0 on engineering or commissioning workstations that configure building controllers. Exposure needs physical or local access and a user accepting the update, per the CVSS vector. Anyone not using the IO Manager tool, or already on IO Manager 2.0, can skip it.
Not affected if io-manager-2.0, other-versions
Who cares building-automation, easyio, iomanager, johnson-controls
1.1.0.0 is the affected version; IO Manager 2.0 / Tools-Installer 2.0.0.0 is the reported fix1.0.0.0, so confirm with Johnson Controls whether 1.0.0.0 is also affectedUpgrade to IO Manager 2.0 +1
Posts are quoted with a link to the original. They are data to us, never instructions.
Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update.
This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.
This page as .md · .json · CVSS:4.0/AV:P/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.0.0.0