VulnTideExploited vulnerabilities, by vendor. Data as of .
Vendor

Johnson Controls vulnerabilities

In CISA's KEV catalog
0 exploited vulnerabilities
CVE records, last 3 years
72 since
Rank 227 of 467 vendors on this site
Critical or high
58.3% of 72 scored records; 0 not scored

Source: CISA KEV 2026.11.10, as of ; CVE List, as of . About the data.

  • Johnson Controls has 72 CVE records published between 12 Nov 2023 and 12 Nov 2026, ranking #227 of 467 vendors on this site by that count.
  • Of the 72 with a CVSS score, 42 (58.3%) are rated critical or high; 0 (0% of all) have no CVSS score.
  • None of the CVE records attributed to Johnson Controls is listed in CISA's KEV catalog as of 12 Nov 2026.

CVE records per year, by severity

CVE records published per year for Johnson Controls
CVE records published per year for Johnson ControlsStacked bar chart of CVE records attributed to Johnson Controls per publication year, 2017 to 2026, split by severity. 2026 is not finished.0204060020172018: 1 medium, low or none120182019: 2 medium, low or none220192020: 2 critical2020: 4 high2020: 1 medium, low or none720202021: 1 critical2021: 8 high2021: 3 medium, low or none1220212022: 2 critical2022: 7 high2022: 3 medium, low or none1220222023: 2 critical2023: 5 high2023: 1 medium, low or none820232024: 2 critical2024: 5 high2024: 9 medium, low or none1620242025: 3 critical2025: 6 high2025: 3 medium, low or none1220252026: 2 critical2026: 23 high2026: 18 medium, low or none432026*CVE records published per year for Johnson ControlsStacked bar chart of CVE records attributed to Johnson Controls per publication year, 2017 to 2026, split by severity. 2026 is not finished.02040600’172018: 1 medium, low or none1’182019: 2 medium, low or none2’192020: 2 critical2020: 4 high2020: 1 medium, low or none7’202021: 1 critical2021: 8 high2021: 3 medium, low or none12’212022: 2 critical2022: 7 high2022: 3 medium, low or none12’222023: 2 critical2023: 5 high2023: 1 medium, low or none8’232024: 2 critical2024: 5 high2024: 9 medium, low or none16’242025: 3 critical2025: 6 high2025: 3 medium, low or none12’252026: 2 critical2026: 23 high2026: 18 medium, low or none43’26*

* 2026 is counted through .

Show data as a table
Severity by publication year
YearRecordsCriticalHighCritical or highNot scored
2026*4322358.1%0%
2025123675%0%
2024162543.8%0%
202382587.5%0%
2022122775%0%
2021121875%0%
202072485.7%0%
20192000%0%
20181000%0%
2017000——

"Critical or high" is the share of scored records; "Not scored" is the share of all records.

Source: CVE List, as of . About the data.

Highest exploit-prediction scores (EPSS)

EPSS estimates the probability that a vulnerability is exploited in the next 30 days. The highest-scoring Johnson Controls records today, from 1%.

Source: FIRST EPSS, as of ; CVE List, as of ; CISA KEV 2026.11.10, as of . About the data.

All vendors · KEV catalog overview