---
id: "CVE-2026-64894"
page: "https://infrastack.ai/live/CVE-2026-64894"
kind: "vulnerability"
aliases: ["CVE-2026-64894"]
title: "Johnson Controls EasyIO Neo IOManager: untrusted update source lets malicious software install"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EasyIO Neo IOManager and Tools Installer", "fixed": ["IO Manager 2.0", "Tools-Installer 2.0.0.0"], "affected": "1.1.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["building-automation", "easyio", "infrastructure", "iomanager", "johnson-controls"]
not_affected_if: ["io-manager-2.0", "other-versions"]
published_at: "2026-11-06T15:17:22+00:00"
first_seen_at: "2026-11-06T15:42:45+00:00"
updated_at: "2026-11-06T15:45:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64894", "first_seen_at": "2026-11-06T15:42:45+00:00"}, {"source": "analyst", "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories", "first_seen_at": "2026-11-06T15:45:23+00:00", "cites": ["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories", "https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/"]}]
exploit_sources: []
---

# Johnson Controls EasyIO Neo IOManager: untrusted update source lets malicious software install

Link for people: https://infrastack.ai/live/CVE-2026-64894 (this .md is for agents)

NVD and Johnson Controls (JCI-PSA-2026-15) list EasyIO Neo IOManager and Tools Installer 1.1.0.0 as affected by a malicious software update flaw. A secondary summary describes it as replacement of unsigned binaries or libraries. The CVSS 4.0 vector is physical access, high complexity, with user interaction. No exploitation is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EasyIO Neo IOManager and Tools Installer affected 1.1.0.0 fixed IO Manager 2.0, Tools-Installer 2.0.0.0

## How to check

Check the installed EasyIO Neo IO Manager and Tools Installer version. 1.1.0.0 is the affected version; IO Manager 2.0 / Tools-Installer 2.0.0.0 is the reported fix. JCI's uninstall steps reportedly refer to 1.0.0.0, so confirm with Johnson Controls whether 1.0.0.0 is also affected.

## Fix

Per a secondary summary of JCI-PSA-2026-15: upgrade to IO Manager 2.0 and Tools-Installer 2.0.0.0. Not confirmed on the vendor page.

## Timeline

- 2026-11-06T15:42:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64894
- 2026-11-06T15:45:23+00:00 analyst https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories — Vendor advisory JCI-PSA-2026-15 (Nov 3 2026) is listed on JCI's index, but I could not open the advisory text itself; fix and details come from a Viakoo summary, so nothing is marked verified. Not exploited per that summary. To settle: read JCI-PSA-2026-15 itself.

## Documents

- [advisory] Johnson Controls Product Security Advisories (lists JCI-PSA-2026-45, CVE-2026-106019) https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
- [describes] Daily OT Security News: November 05, 2026 (Viakoo) https://www.viakoo.com/blog/daily-ot-security-news-november-05-2026/

## From the sources

Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update.

This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_