Cross-Site Scripting Vulnerability in Johnson Controls Metasys Products
CVE-2026-34491

6.1MEDIUM

Key Information:

Vendor: Johnson Controls
Status: Metasys 14; Metasys 15
Vendor: CVE Published:; 24 August 2026

🔔 Create Johnson Controls Vulnerability Alert

What is CVE-2026-34491?

A vulnerability in Johnson Controls Metasys Products allows for improper neutralization of input during web page generation, leading to cross-site scripting. Affected versions include Metasys 14 prior to 14.1.5 and Metasys 15 prior to 15.0.1. This flaw could enable attackers to inject malicious scripts, potentially compromising the integrity of user interactions with the affected systems.

Affected Version(s)

Metasys 14 0 < 14.1.5

Metasys 15 0 < 15.0.1

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:

6.1

Severity:

MEDIUM

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 24, 2026
Vulnerability Reserved
Mar 30, 2026

CVE-2026-34491 Data

JSON