High severity · published Oct 1, 2026
CVE-2026-71452
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection
7.2
CVSS
0.7%
EPSS
No
On KEV
Description
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection.
This issue affects EasyIO FS32: before 3.0b63.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
EasyIO FS32 · Johnson Controls
before 3.0b63 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71452
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71452
www.johnsoncontrols.com
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
More from EasyIO FS32
9.3
CVE-2026-71449
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data
7.2
CVE-2026-34493
- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations
5.6
CVE-2026-71448
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse
5.6
CVE-2026-71453
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack
5.6
CVE-2026-71451
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection