Vendor
Johnson Controls
103 known vulnerabilities in products by Johnson Controls, 0 of them actively exploited (CISA KEV).
Key figures
103
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
24
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-21654 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution | 9.8 | |
| High | CVE-2020-9047 | exacqVision Software - Improper Verification of Cryptographic Signature | 6.8 | |
| Critical | CVE-2025-26385 | Metasys product command injection vulnerability could allow remote SQL execution | — | |
| Critical | CVE-2022-21941 | iSTAR Ultra | 10.0 | |
| High | CVE-2020-9050 | Johnson Controls Metasys Reporting Engine: Path Traversal | 7.5 | |
| High | CVE-2021-27660 | C-CURE 9000 | 8.8 | |
| Critical | CVE-2026-21659 | Johnson Controls Frick Controls Quantum HD: Relative Path Traversal | 9.8 | |
| Critical | CVE-2019-7589 | Kantech EntraPass Improper Input Validation | 9.8 | |
| Critical | CVE-2021-27664 | exacqVision Web Service | 9.8 | |
| Critical | CVE-2021-27663 | CEM Systems AC2000 | 8.2 | |
| High | CVE-2026-71452 | Johnson Controls EasyIO FS32: OS Command Injection | — | |
| Critical | CVE-2023-2024 | Improper Authentication for OpenBlue Enterprise Manager Data Collector | 10.0 | |
| Critical | CVE-2026-21658 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution | 9.8 | |
| Critical | CVE-2026-21662 | FMS Employee Allows Upload of Unrestricted Files | 9.8 | |
| High | CVE-2021-27665 | exacqVision Server 32-bit | 7.5 | |
| High | CVE-2021-27657 | Metasys Improper Privilege Management | 8.8 | |
| Critical | CVE-2020-9045 | Tyco Victor Video Management System: Cleartext Storage of Sensitive Information | 9.9 | |
| Critical | CVE-2023-4804 | Quantum HD Unity | 10.0 | |
| Critical | CVE-2026-71449 | Johnson Controls EasyIO FS32: Use of Hard-coded Cryptographic Key | — | |
| High | CVE-2026-21655 | C-CURE 9000 and Victor application server - Deserialization of Untrusted Data | — | |
| Medium | CVE-2026-34498 | Johnson Controls Illustra Standard - L4L China: Improper Input Validation | — | |
| High | CVE-2021-36198 | Johnson Controls Entrapass: Exposure of Sensitive Information to an Unauthorized Actor | 8.3 | |
| High | CVE-2026-71450 | Johnson Controls EasyIO Neo EC and CW Edge Controller: Authentication Bypass Using an Alternate Path or Channel | — | |
| Critical | CVE-2020-9044 | Metasys Improper Restriction of XML External Entity Reference | 7.5 | |
| Critical | CVE-2026-21657 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution | 9.8 |
News
- Johnson Controls PowerG, IQPanel and IQHubcisa-advisories,