Johnson Controls Metasys CVE-2026-34491

Exploitation requires the attacker to hold a valid, low-privileged authenticated session on the Johnson Controls Metasys web interface (PR:L from CVSS 4.0 vector). A victim user with higher privileges must then load or interact with the page containing the injected payload (UI:P). The vulnerability is limited to Metasys versions 14.x before 14.1.5 and 15.x before 15.0.1; systems already updated to the fixed releases are not affected. Exploitation is bounded to the web interface context and does not directly extend to subsequent systems per the CVSS 4.0 SC:N/SI:N/SA:N metrics. External internet-exposed deployments of the Metasys web interface would face a broader threat surface than air-gapped or VPN-only deployments.

The NVD CVSS score of 6.1 and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) suggest moderate exploitability with a meaningful but conditional threat profile. The PR:L requirement means an attacker must first obtain low-privileged access to the Metasys web interface, which constrains the attack surface to authenticated sessions. The UI:P flag confirms a victim must actively view the injected content, limiting opportunistic exploitation. The CVSS 4.0 vector assigns VC:H/VI:H/VA:H, which appears elevated relative to a typical web-only XSS vulnerability - however, in the context of a BMS like Metasys, session hijacking of a privileged operator could yield high-impact control over building systems, which may justify these ratings. The EPSS score is not provided, and the E:U supplemental flag confirms no known exploitation in the wild. This vulnerability is not in the CISA KEV catalog and no proof-of-concept code has been identified, supporting a treat-with-urgency-but-not-emergency posture. CONFLICT NOTE: The CVSS 6.1 score is inconsistent with the VC:H/VI:H/VA:H CVSS 4.0 vector provided - the latter would typically yield a CVSS 4.0 score above 7.0. This discrepancy should be verified against the Johnson Controls advisory.

An attacker with low-privileged access to the Metasys web interface - such as a contractor or facility technician - submits crafted input containing a malicious JavaScript payload into a field that is later rendered unsanitized in another user's browser session. When a higher-privileged Metasys operator views the affected page, the script executes in their browser context, potentially stealing their session token or performing unauthorized building automation actions on the attacker's behalf. No public proof-of-concept code has been identified at the time of analysis.