Vulnerabilities

CVSS

6.1 Medium

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Risk score

48.8

Published

2026-08-24

Status

Published

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

Weaknesses

Improper neutralization of input during web page generation ('cross-site scripting')CWE-79

Coverage 1

vulnerability

Johnson Controls Metasys

A vulnerability in Johnson Controls Metasys allows a low-privilege user to inject malicious code via a crafted URL, potentially leading to session hijacking and unauthorized access across multiple versions. The vulnerabi…

CISA Advisories · Aug 13, 2026 Critical

CVE-2026-34491cve-2026-34491xsscisa

All articles mentioning it

Advisories and references

• johnsoncontrols.com/trust-center/cybersecurity/security-advisories