CISA warns of high-severity Metasys cross-site scripting flaw

By Atlas Watchline Staff · Regulatory · August 13, 2026

CISA issued an advisory on Aug. 13 about a high-severity cross-site scripting flaw in Johnson Controls Metasys that could let a crafted link run malicious code in other users’ browsers.

CISA on Aug. 13 published an advisory on a high-severity cross-site scripting vulnerability in Johnson Controls Metasys, a building automation platform. The agency said a crafted URL could allow a low-privilege user to inject a persistent malicious payload into the system’s web interface.

According to the advisory, the payload can persist across logins and run in the browser context of other users, including administrators. CISA said the flaw could lead to session hijacking and unauthorized access.

The advisory identifies the issue as CVE-2026-34491 and says it stems from improper neutralization of input during web page generation, also known as cross-site scripting or CWE-79. CISA assigned the vulnerability a CVSS v3.1 base score of 8.0 and a CVSS v4.0 base score of 8.6, both rated high.

According to the advisory, affected products include Metasys 12 and Metasys 13, both listed as all versions; Metasys 14 before version 14.1.5; and Metasys 15 before version 15.0.1. CISA said Metasys 16.0 is not impacted because the issue was fixed before release. It also said Metasys 11 and earlier are not affected because the vulnerability was introduced in version 12.

The advisory says Metasys 12 and 13 are at end of support and recommends updating to a later version. It also notes that a patch for Metasys 15.0 was released on March 25, 2026, and that a patch for Metasys 14.1.5 was forecast for July 15, 2026.

CISA said it had no known public reports of exploitation specifically targeting this vulnerability at the time of publication. The advisory credits an anonymous researcher with reporting the issue to Johnson Controls and points readers to Johnson Controls Product Security Advisory JCI-PSA-2026-11 for mitigation details.

Sources

• CISA advisory ICSA-26-225-14

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.