CVE-2026-106018: High severity vulnerability
Published Nov 12, 2026
·Updated
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.
This issue affects EasyIO FW: through 3.0b25.
Event History
Nov 12, 2026
CVE Published
via MITRE·08:50 PM
Data Sourced
via MITRE·08:50 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which EasyIO FW versions are affected?
The issue affects Johnson Controls EasyIO FW through version 3.0b25.
2
Does exploitation require prior authentication or user interaction?
The supplied vector indicates that an attacker needs high privileges and user interaction, and that exploitation has high attack complexity with an additional attack requirement. The attack vector is network-based.