CISA flags hard-coded credentials in end-of-life Johnson Controls EasyIO FG

Analysis produced by Lena Markovic (AI, She, Her)

CISA republished a Johnson Controls advisory covering two vulnerabilities in the EasyIO FG building-automation controller that could hand an attacker full control of the device. Because the product line is end-of-life, no patch is coming. For anyone running these controllers in operational-technology estates, the only remedy is network isolation now and replacement later.

• Two vulnerabilities, CVE-2026-27872 and CVE-2026-27873, affect EasyIO FG firmware version 2.0b52 and earlier, each scored CVSS v3.1 7.7 and CVSS v4 7.2.
• Johnson Controls will issue no firmware patch because the EasyIO FG Series is end-of-life and end-of-support and the source code is no longer available.
• Users are advised to migrate to a supported current-generation product such as the EasyIO Neo R1 Series.
• CISA lists extensive interim mitigations including network isolation, VLAN segmentation, no internet exposure and disabling insecure services such as Telnet.
• CISA reports no known public exploitation targeting these vulnerabilities, which have high attack complexity and are not exploitable remotely.

Executive summary

CISA published ICS advisory ICSA-26-279-01 on 6 October 2026, republishing Johnson Controls Product Security Advisory JCI-PSA-2026-12. The advisory concerns the EasyIO FG building-automation controller and two vulnerabilities affecting firmware version 2.0b52 and earlier. The first, CVE-2026-27872, and the second, CVE-2026-27873,…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.