No patch is coming for the retired line
CISA’s October 6 advisory covers CVE-2026-27872 and CVE-2026-27873 in Johnson Controls EasyIO FG firmware through version 2.0b52. The weaknesses concern hard-coded credentials and privilege management. The advisory says the product is past support, is no longer manufactured, and will receive no firmware fix. Johnson Controls recommends migration to supported equipment.
Scope the exposure accurately
CISA describes high attack complexity and local rather than remote exploitation, and says it has received no reports of known public exploitation specifically targeting these vulnerabilities. Recommended mitigations include isolated building-automation or operational-technology networks, restricted engineering access and protection against unauthorized physical or console access. This is an equipment lifecycle issue requiring attention, not evidence that an operator’s facility has already been attacked.
A replacement project needs operational ownership
For energy facilities, transport sites and manufacturers, our assessment is that the first meeting should include the people responsible for the building system, the network and maintenance procurement. A controller can disappear between those departments’ inventories even when each believes its own records are complete. Confirm the installed equipment and firmware before estimating the work. Then identify which physical process or building service depends on it, which contractor has access and what constraints govern a maintenance window. That information determines whether an interim restriction is practical and what needs to be tested before replacement.
Make temporary controls expire through a decision
Record the interim arrangement, its owner and the date management will review it. A network restriction is easier to sustain when operations staff know why it exists and how to request authorized maintenance. Include contractor access and local servicing in that procedure, since an internet-only inventory would miss the advisory’s local-access conditions. Before any cutover, agree on acceptance checks with the equipment specialist and a recovery plan if the change affects service. The objective is a supported, maintainable installation with documented ownership. Merely filing the advisory under a patched-or-unpatched dashboard leaves the underlying replacement decision unresolved.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
