> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Johnson Controls Metasys
- URL: https://f4n6.co.uk/security-feed/johnson-controls-metasys/
- Published: 2026-08-13T20:32:38.000Z
- Updated: 2026-08-13T20:32:38.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

A persistent cross-site scripting (XSS) vulnerability — CVE-2026-34491, CVSS v3.1 8.0 (HIGH) / v4.0 8.6 (HIGH) — affects Johnson Controls Metasys building automation system (BAS) versions 12 through 15\. A low-privilege authenticated user can inject a malicious payload via a crafted URL that persists across sessions and executes in the browser context of other users, including administrators, enabling session hijacking and unauthorised access. CISA reports no known public exploitation at the time of advisory publication, and the CVE is not listed on the CISA KEV catalogue. EMEA financial services running Metasys in branch or campus facilities face risk of attacker pivot from OT/BAS networks into corporate IT segments if administrator sessions are compromised.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The vulnerability affects a building automation system; while it could indirectly implicate ICT third-party risk or operational resilience, no distinctive fact in this advisory triggers a specific article obligation beyond what would apply to any security vulnerability affecting a vendor product.

## 3\. Technical analysis & attack chain

**CVE-2026-34491** — CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting).

**CVSS v3.1:** 8.0 HIGH — `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H` **CVSS v4.0:** 8.6 HIGH — `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

### Affected versions

- Metasys 12 (all versions) — end of support
- Metasys 13 (all versions) — end of support
- Metasys 14: < v14.1.5
- Metasys 15: < v15.0.1
- Metasys 11 & prior: not affected (vulnerability introduced at v12)
- Metasys 16.0: not impacted (fixed prior to release)

### Attack chain (confirmed from CISA advisory)

1. **Initial access / authentication:** Attacker authenticates to the Metasys UI with a low-privilege account. The attack requires valid credentials at a low privilege level (PR:L).
2. **Payload injection:** Attacker submits a crafted URL containing a malicious XSS payload to the Metasys web UI. The payload is not properly neutralised by the application (CWE-79).
3. **Persistence:** The injected payload persists in the application — it survives across user logins and session boundaries. This is a stored/persistent XSS vector, not a reflected-only XSS.
4. **Execution in victim context:** When another user (including an administrator) accesses the affected page, the payload executes in their browser context. User interaction is required (UI:R / UI:P) — the victim must load the compromised page.
5. **Session hijacking:** With script execution in the administrator's browser, the attacker can steal session tokens, perform actions as the administrator, or redirect to attacker-controlled infrastructure. The CVSS vector confirms high impact to confidentiality, integrity, and availability (C:H/I:H/A:H).

**Network exposure:** Attack vector is network-adjacent (AV:N) — the Metasys UI must be reachable. CISA and the vendor both warn against internet exposure.

**Attribution:** No threat actor is named in the source material. The vulnerability was reported by an anonymous researcher. Attribution is unconfirmed and no actor profile is available.

**Confidence caveat:** All technical detail above is single-sourced from CISA ICS Advisory ICSA-26-225-14 and the associated Johnson Controls Product Security Advisory JCI-PSA-2026-11\. No independent corroboration of exploitation in the wild is available.

## 4\. Mitigation & containment

### P1 — Within 24 hours

- **Identify all Metasys deployments** across the estate. Inventory versions and confirm whether any Metasys UI is internet-exposed. If exposed, immediately restrict access to trusted networks/VPN only.
- **Block direct internet access** to Metasys UI at the firewall/WAF layer. The UI should not be reachable from outside the corporate or OT management network.
- **Enforce network segmentation:** Ensure BAS/OT networks hosting Metasys are isolated from corporate IT. Inter-segment traffic should pass through controlled gateways.

### P2 — Within 72 hours

- **Patch Metasys 15.0** to v15.0.1 or later (patch released 2026-03-25).
- **Patch Metasys 14.x** to v14.1.5 (forecast release 2026-07-15 — verify availability with Johnson Controls).
- **Metasys 12 and 13:** These versions are end of support. Plan immediate upgrade to Metasys 16.0\. No patch will be issued for these versions.
- **Deploy a WAF** in front of the Metasys UI to detect and block common XSS payload patterns.
- **Implement Content Security Policy (CSP) headers** and other HTTP security headers (X-Content-Type-Options, X-Frame-Options) at the reverse proxy or load balancer layer in front of Metasys.
- **Review Metasys UI access logs** for suspicious URL patterns containing script tags, JavaScript URIs, or encoded payloads. Look for parameters containing `<script>`, `javascript:`, `onerror=`, `onload=`, or base64-encoded content in URL parameters.

### P3 — Within 7 days

- **Enforce least-privilege access** on all Metasys user accounts. Reduce the number of low-privilege accounts that could serve as an entry point for payload injection.
- **Educate Metasys users** not to click untrusted or unexpected links targeting the Metasys UI — the XSS requires victim interaction (UI:R).
- **Upgrade to Metasys 16.0** where feasible — this version is not impacted and was fixed prior to release.
- **Refer to Johnson Controls Product Security Advisory JCI-PSA-2026-11** at the Johnson Controls Trust Center Security Advisories page for vendor-specific patch application instructions.
- **Conduct a retrospective review** of Metasys UI access logs for the period prior to patching to identify any evidence of prior XSS payload injection.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

### Behavioural indicators

| Behaviour                                                                        | Where to observe                                                                                           | Confidence                                                               |
| -------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| Suspicious URL patterns containing script tags or JavaScript in query parameters | Metasys UI access logs, WAF logs, reverse proxy logs                                                       | Medium — derived from vulnerability mechanism, not observed exploitation |
| Unexpected script execution in user browser sessions                             | Browser developer console, EDR browser monitoring, CSP violation reports                                   | Medium — derived from vulnerability mechanism                            |
| Privilege escalation via session token theft                                     | Metasys audit logs — low-privilege account actions followed by admin-level actions from same session/token | Low — speculative based on attack chain                                  |

## 6\. Detection

Insufficient indicators to author detection rules. The source material describes the vulnerability mechanism (stored XSS via crafted URL) but does not provide specific payload strings, file paths, filenames, registry keys, mutex names, or other artefacts suitable for YARA or Sigma rule construction. WAF rules targeting generic XSS patterns (script tags, JavaScript URIs, event handlers in URL parameters) applied to Metasys UI traffic are the primary detection avenue — configure these per your WAF vendor's XSS signature set.

## 7\. Sources

- CISA, *Johnson Controls Metasys — ICSA-26-225-14*, https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-14, 2026-08-13
- Johnson Controls, *Product Security Advisory JCI-PSA-2026-11*, referenced via CISA advisory (URL not directly provided in source material)
- CISA, *Johnson Controls OpenBlue Employee — ICSA-26-211-02* (related context), https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-02

## 8\. Adverse Trace position

CVE-2026-34491 is a HIGH-severity stored XSS vulnerability (CVSS v3.1 8.0) in a widely deployed building automation system. The attack requires authenticated access at low privilege and victim interaction, which slightly constrains exploitability, but the persistent nature of the payload and the potential for administrator session hijacking make this a serious risk for any organisation running affected Metasys versions with internet-exposed or broadly accessible UIs. No exploitation in the wild has been reported and the CVE is not on the CISA KEV catalogue. EMEA financial services clients should treat this as a P2 remediation item: patch Metasys 15.0 to v15.0.1 immediately, confirm v14.1.5 availability, and accelerate retirement of end-of-support versions 12 and 13\. We will monitor for any indication of active exploitation or KEV addition and update this advisory if the threat landscape changes.

---

[Read the original source →](https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-14?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*