Johnson Controls Metasys

View CSAF Summary Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and unauthorized access. The following versions of Johnson Controls Metasys are affected: Metasys 12 vers:all/* (CVE-2026-34491) Metasys 13 vers:all/* (CVE-2026-34491) Metasys 14 Metasys 15 CVSS Vendor Equipment Vulnerabilities v3 8 Johnson Controls Inc Johnson Controls Metasys Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Background Critical Infrastructure Sectors: Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland Vulnerabilities Expand All + CVE-2026-34491 A low-privilege user can inject a malicious XSS payload into the Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators. View CVE Details Affected Products Johnson Controls Metasys Vendor: Johnson Controls Inc Product Version: Johnson Controls Inc Metasys 12: vers:all/*, Johnson Controls Inc Metasys 13: vers:all/*, Johnson Controls Inc Metasys 14: <v14.1.5, Johnson Controls Inc Metasys 15: <v15.0.1 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following actions: Mitigation User are recommended to apply the latest available patches for affected Metasys versions Mitigation Metasys 16.0: Not impacted, fixed prior to release Vendor fix Metasys 15.0: Patch released 2026-03-25 Vendor fix Metasys 14.1.5: Forecast release 2026-07-15 Vendor fix Metasys 13: End of support, update to later version Vendor fix Metasys 12: End of support, update to later version Mitigation Metasys 11 & prior: Not affected (vulnerability introduced at version 12) Mitigation To help reduce the risk of exploitation, we suggest considering the following defensive measures: Mitigation Upgrade to Metasys version 16.0 or apply the latest available patch for your version (15.0.1 or 14.1.5 when available) Mitigation Restrict network access to the Metasys UI to trusted networks and users only; do not expose the interface directly to the internet Mitigation Implement network segmentation to isolate building automation systems from the corporate IT network Mitigation Enforce least-privilege access controls – limit user accounts to the minimum permissions necessary Mitigation Implement Content Security Policy (CSP) headers and other HTTP security headers where possible at the network/proxy level Mitigation Monitor for suspicious URL patterns and unexpected script execution in Metasys UI access logs Mitigation Use a web application firewall (WAF) in front of the Metasys UI to detect and block common XSS payloads Mitigation Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI Mitigation For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-11 at the following location: Security Advisories. Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Metrics CVSS Version Base Score Base Severity Vector String 3.1 8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H 4.0 8.6 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Acknowledgments An anonymous researcher reported this vulnerability to Johnson Controls Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/