Johnson Controls Metasys Cross-Site Scripting Vulnerability (CVE-2026-34491)

Johnson Controls has identified a cross-site scripting vulnerability in the Metasys building automation platform. According to CISA and the vendor advisory, successful exploitation could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators. This could lead to session hijacking and unauthorized access.

The affected versions include Metasys 12 (vers:all/*), Metasys 13 (vers:all/*), Metasys 14 (

Johnson Controls recommends that users apply the latest available patches. Metasys 15.0 received a patch released on 2026-03-25. Metasys 14.1.5 is forecast for release on 2026-07-15. Metasys 16.0 is not impacted, as the fix was applied prior to release. Metasys 12 and 13 are end-of-support; Johnson Controls advises upgrading to a later version. Additional mitigation measures include restricting network access to the Metasys UI, implementing network segmentation, enforcing least-privilege access controls, deploying Content Security Policy headers, and using a web application firewall.