CISA ICS: Johnson Controls EasyIO Neo Series EC and CW Controllers
CISA ICS has published a new security advisory. Here is a summary and what to do.
Key points
- New advisory from CISA ICS.
- Review affected versions in the advisory.
- Apply updates promptly.
CISA ICS published a security advisory titled “Johnson Controls EasyIO Neo Series EC and CW Controllers”.
At a glance
- Publisher
- CISA ICS
- CVEs
- CVE-2026-64893
What the advisory says
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data. The following versions of Johnson Controls EasyIO Neo Series EC and CW Controllers are affected: EasyIO Neo Series EC Controllers V3.3b62 (CVE-2026-64893) EasyIO Neo Series EC Controllers V3.3b63 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b24 (CVE-2026-64893) EasyIO Neo Series CW Controllers V3.3b25 (CVE-2026-64893) CVSS Vendor Equipment Vulnerabilities v3 5.4 Johnson Controls Johnson Controls EasyIO Neo Series EC and CW Controllers Cleartext Transmission of Sensitive Information Background Critical Infrastructure Sectors: Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland
What should you do?
- Read the full vendor advisory linked below and confirm whether you run affected versions.
- Schedule the recommended update, prioritising internet-facing systems.
- Watch for exploitation reports; unpatched edge devices are frequent targets.
What to do and how to stay safe: CVE-2026-64893
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
