Johnson Controls Metasys: 1 CVE, High 8.0
Summary
CISA reports 1 vulnerability in Johnson Controls Metasys 12, Metasys 13, Metasys 14, Metasys 15. Weakness type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and unauthorized access. Highest CVSS v3 score: 8.0 (High), exploitable over the network.
At a glance
- Vendor
- Johnson Controls
- Products
- Metasys 12, Metasys 13, Metasys 14, Metasys 15
- CVEs
- CVE-2026-34491
- Highest CVSS v3
- 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy
- Deployed
- Worldwide
- Vendor HQ
- Ireland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-34491 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 8.0 | – | No | A low-privilege user can inject a malicious XSS payload into the Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators. |
Affected products (4)
- Johnson Controls Inc Metasys 12: vers:all/*
- Johnson Controls Inc Metasys 13: vers:all/*
- Johnson Controls Inc Metasys 14: <v14.1.5
- Johnson Controls Inc Metasys 15: <v15.0.1
Vendor fixes and mitigations (from advisory)
- Mitigation: Johnson Controls recommends the following actions:
- Mitigation: User are recommended to apply the latest available patches for affected Metasys versions
- Mitigation: Metasys 16.0: Not impacted, fixed prior to release
- Vendor Fix: Metasys 15.0: Patch released 2026-03-25
- Vendor Fix: Metasys 14.1.5: Forecast release 2026-07-15
- Vendor Fix: Metasys 13: End of support, update to later version
- Vendor Fix: Metasys 12: End of support, update to later version
- Mitigation: Metasys 11 & prior: Not affected (vulnerability introduced at version 12)
- Mitigation: To help reduce the risk of exploitation, we suggest considering the following defensive measures:
- Mitigation: Upgrade to Metasys version 16.0 or apply the latest available patch for your version (15.0.1 or 14.1.5 when available)
- Mitigation: Restrict network access to the Metasys UI to trusted networks and users only; do not expose the interface directly to the internet
- Mitigation: Implement network segmentation to isolate building automation systems from the corporate IT network
- Mitigation: Enforce least-privilege access controls – limit user accounts to the minimum permissions necessary
- Mitigation: Implement Content Security Policy (CSP) headers and other HTTP security headers where possible at the network/proxy level
- Mitigation: Monitor for suspicious URL patterns and unexpected script execution in Metasys UI access logs
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.