ICSA-26-225-14

icsaUScisa_csaf_ot

Johnson Controls Metasys

view advisory published 2026-08-13

Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and unauthorized access.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2026-34491US——
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site…
02

references

External citations — patches, advisories, analysis.

03

remediations (8)

  • MitigationMetasys 12

    Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI

  • MitigationMetasys 13

    Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI

  • MitigationMetasys 14

    Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI

  • MitigationMetasys 15

    Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI

  • FixedMetasys 12

    Metasys 12: End of support, update to later version

  • FixedMetasys 13

    Metasys 13: End of support, update to later version

  • FixedMetasys 14

    Metasys 14.1.5: Forecast release 2026-07-15

  • FixedMetasys 15

    Metasys 15.0: Patch released 2026-03-25

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan