Johnson Controls Warns of High-Severity EasyIO FG Vulnerabilities
Tech GuruQuick Answer
The authority published JCI-PSA-2026-12 for Johnson Controls EasyIO FG building-automation controllers. Johnson Controls documents two high-severity weaknesses in the end-of-life EasyIO FG controller line. The vendor does not provide a fixed FG firmware and directs customers toward replacement with a supported platform. Affected deployments should be matched to the authority's exact scope and moved to the supported fixed release.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Johnson Controls EasyIO FG building-automation controllers, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Johnson Controls EasyIO FG building-automation controllers |
|---|---|
| Advisory | JCI-PSA-2026-12 |
| CVEs | CVE-2026-27872, CVE-2026-27873 |
| Authoritative release date | 2026-10-01 (Johnson Controls date; no time stated) |
| Authority revision date | Initial publication; no later material revision stated when verified |
| Affected versions | EasyIO FG firmware 2.0b52 and earlier. |
| Fixed version | No fixed EasyIO FG firmware; migrate the end-of-life controller to a supported current-generation platform such as EasyIO Neo R1 |
| CVSS base score | 7.2 (official CVSS v4.0) |
| CVSS severity | High |
| Exploitation status | Johnson Controls does not report known public exploitation; no exploitation claim is inferred. |
What Changed
Johnson Controls documents two high-severity weaknesses in the end-of-life EasyIO FG controller line. The vendor does not provide a fixed FG firmware and directs customers toward replacement with a supported platform.
What To Validate Now
- Inventory. Locate Johnson Controls EasyIO FG building-automation controllers deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Identify EasyIO FG controllers and confirm firmware 2.0b52 or earlier. Do not infer that EasyIO Neo products share this end-of-life disposition.
- Remediate. Plan migration to a supported current-generation controller, isolate affected devices and management interfaces, restrict remote access to approved paths, and follow current Johnson Controls hardening guidance until replacement is complete.
- Validate. Confirm segmentation and access controls, review controller and network telemetry, validate building-automation logic after migration, and document every temporary exception and retirement decision.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Controller replacement can affect HVAC, lighting, energy, and safety-adjacent workflows. Back up logic and configuration, coordinate an operational window, preserve evidence, and maintain a tested rollback plan.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
