CVE-2026-27872

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-02

Assigner: Johnson Controls

Description

- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.0b52.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-27872

EUVD

EUVD-2026-91041

Affected Vendors & Products

Vendor	Product	Version / Range
Johnson	Controls	Easy IO FG 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-27872 is an Improper Privilege Management vulnerability in Johnson Controls Easy IO FG software versions before 2.0b52. It allows attackers to bypass authentication through brute force methods, potentially gaining unauthorized access to the system.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. Check Johnson Controls' official security advisories for guidance.

Impact Analysis

This vulnerability could allow unauthorized users to gain elevated privileges on affected systems. Attackers might access sensitive building management data, alter system configurations, or disrupt operations. Systems running older versions of Easy IO FG are at risk.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves improper privilege management allowing brute force attacks, which could potentially lead to unauthorized access to sensitive data. This may pose risks to compliance with regulations requiring strict access controls and data protection measures.

Mitigation Strategies

Update Johnson Controls Easy IO FG to version 2.0b52 or later to address the improper privilege management vulnerability.

Hi! I’m here to help you understand CVE-2026-27872. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70