Vendor
Johnson Controls
72 known vulnerabilities in products by Johnson Controls, 0 of them actively exploited (CISA KEV).
Key figures
72
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
25
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-21654 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution | 9.8 | |
| High | CVE-2020-9047 | exacqVision Software - Improper Verification of Cryptographic Signature | 6.8 | |
| Critical | CVE-2022-21941 | iSTAR Ultra | 10.0 | |
| High | CVE-2020-9050 | Johnson Controls Metasys Reporting Engine: Path Traversal | 7.5 | |
| High | CVE-2021-27660 | C-CURE 9000 | 8.8 | |
| Critical | CVE-2026-21659 | Johnson Controls Frick Controls Quantum HD: Relative Path Traversal | 9.8 | |
| Critical | CVE-2019-7589 | Kantech EntraPass Improper Input Validation | 9.8 | |
| Critical | CVE-2021-27664 | exacqVision Web Service | 9.8 | |
| Critical | CVE-2021-27663 | CEM Systems AC2000 | 8.2 | |
| Critical | CVE-2023-2024 | Improper Authentication for OpenBlue Enterprise Manager Data Collector | 10.0 | |
| Critical | CVE-2026-21658 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution | 9.8 | |
| Critical | CVE-2026-21662 | FMS Employee Allows Upload of Unrestricted Files | 9.8 | |
| High | CVE-2021-27665 | exacqVision Server 32-bit | 7.5 | |
| High | CVE-2021-27657 | Metasys Improper Privilege Management | 8.8 | |
| Critical | CVE-2020-9045 | Tyco Victor Video Management System: Cleartext Storage of Sensitive Information | 9.9 | |
| Critical | CVE-2023-4804 | Quantum HD Unity | 10.0 | |
| High | CVE-2021-36198 | Johnson Controls Entrapass: Exposure of Sensitive Information to an Unauthorized Actor | 8.3 | |
| Critical | CVE-2020-9044 | Metasys Improper Restriction of XML External Entity Reference | 7.5 | |
| Critical | CVE-2026-21657 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution | 9.8 | |
| Critical | CVE-2026-21656 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution | 9.8 | |
| High | CVE-2021-36207 | Metasys privilege management | 8.8 | |
| Critical | CVE-2021-36205 | Metasys session token | 8.1 | |
| High | CVE-2022-21934 | Metasys Unverified Password Change | 8.0 | |
| High | CVE-2020-9048 | victor Web Client - Arbitrary File Deletion Vulnerability | 7.1 | |
| High | CVE-2021-27661 | Facility Explorer | 8.8 |