CVE-2026-34491

MediumCVSS 6.1

Published: 24/08/2026(UTC)Updated: 25/08/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

Johnson Controls Metasys 14 and 15 contain a cross-site scripting (XSS) vulnerability due to improper input neutralization during web page generation. Affected versions: Metasys 14 before 14.1.5; Metasys 15 before 15.0.1.

Risk Assessment

An attacker can inject malicious scripts into pages viewed by other users, potentially leading to session theft, account takeover, or other browser-based attacks.

Recommendation

Update Metasys systems to version 14.1.5 or later (for Metasys 14) and 15.0.1 or later (for Metasys 15).

Other vulnerabilities in Johnson Controls Metasys

CVE-2025-26385Critical
Command Injection vulnerability in Johnson Controls Metasys components installed with SQL Express. Successful exploitation could allow remote SQL execution. Affects Metasys ADS, ADX, LCS8500/NAE8500, SCT, and CCT in specific versions.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.