CISA 2026-08-13

Johnson Controls Metasys

CVE-2026-34491

Machine-generated analysis · WAYSCloud LLM

Metasys versions 12-15 are vulnerable to a persistent cross-site scripting flaw (CVE-2026-34491). The flaw allows a low-privilege user to inject a payload that runs in other users' sessions.

Context

Johnson Controls Metasys is a building-management system deployed worldwide in sectors such as critical manufacturing, commercial facilities, government services, transportation and energy. The advisory states that a low-privilege user can inject a persistent XSS payload via a crafted URL, which executes in the browsers of other users, including administrators, potentially enabling session hijacking. Versions 12 and 13 are affected across all releases, while versions 14 and 15 are vulnerable only before v14.1.5 and v15.0.1 respectively.

Operator considerations

Check: Verify the installed Metasys version and compare it to the affected list (12, 13, 14 < v14.1.5, 15 < v15.0.1).
Isolate: Restrict external access to the Metasys web UI and consider URL filtering for crafted parameters.
Patch: Apply the vendor-released patches for Metasys 15.0 (2026-03-25) and the upcoming 14.1.5 release, or upgrade to Metasys 16.0 or later.
Log: Review web UI access logs for suspicious URLs containing script payloads.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and unauthorized access.

The following versions of Johnson Controls Metasys are affected:

Metasys 12 vers:all/* (CVE-2026-34491)

Metasys 13 vers:all/* (CVE-2026-34491)

Metasys 14

Metasys 15

Vendor

Equipment

Johnson Controls Inc

Johnson Controls Metasys

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Critical Infrastructure Sectors: Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Ireland

A low-privilege user can inject a malicious XSS pay...

Read the full advisory on CISA →