CVE-2026-64894

HighCVSS 7.3/10Last modified Nov 11, 2026

Description

Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows Malicious Software Update.

This issue affects EasyIO Neo IOManager and Tools Installer: 1.1.0.0.

Metrics

CVSS 4.0 7.3/10

CVSS:4.0/AV:P/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published: Nov 6, 2026
Last modified: Nov 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-648965.2Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Co CVE-2026-648975.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-648987.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-648995.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-64907.3A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. Impacted is an unknown function of the file CVE-2026-649005.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-649018.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-649025.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-649037.8Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-649047.8Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-649057.8Buffer over-read in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-649067.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.