Stored XSS Vulnerability in Johnson Controls Metasys

Johnson Controls Metasys versions 12, 13, 14, and 15 contain a critical Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-34491. This vulnerability exists because the Metasys UI fails to properly neutralize input during web page generation. An attacker with low-level user privileges can inject a persistent malicious payload via a crafted URL. This payload is stored and subsequently executed within the browser context of any user who views the manipulated URL, including administrative accounts. Successful exploitation could allow an attacker to hijack user sessions, perform unauthorized actions within the building automation system, or gain administrative-level access to the management interface. This flaw poses a significant risk to critical infrastructure sectors, including energy, government services, and transportation, where Metasys is deployed worldwide.

Impact

Successful exploitation of this vulnerability enables attackers to perform actions on behalf of authenticated administrators, leading to unauthorized control of facility management systems. Given the nature of these building automation systems, compromise could lead to operational disruption, loss of monitoring, or access to sensitive environmental controls. There are currently no reports of this vulnerability being exploited in the wild, but the high CVSS score (8.0/8.6) necessitates immediate attention for systems exposed to internal or external networks.

Recommendation

• Apply the latest available patches provided by Johnson Controls: Upgrade to Metasys 16.0, or patch to version 15.0.1 or 14.1.5 (when available).
• Restrict access to the Metasys UI by enforcing network segmentation, ensuring the interface is not exposed to the internet, and limiting access to trusted networks and users.
• Implement Content Security Policy (CSP) headers at the proxy or WAF level to mitigate the impact of injected scripts.
• Monitor Metasys UI access logs for suspicious URL patterns or unexpected script-based payloads.
• Enforce the principle of least privilege to minimize the potential impact if a standard user account is compromised.