Johnson Controls CVE-2026-71454

Exploitation requires an authenticated session with at least low-level privileges (CVSS PR:L) to submit input into an affected, improperly-neutralized field of the web application; it cannot be performed by a fully unauthenticated attacker. Although the supplied vector states UI:N, successful script execution realistically depends on a second user rendering the injected content, which limits reliability and scope. The precise feature or input field, the affected product, and whether the flaw is stored or reflected are not identifiable from the input because the product metadata is corrupted (listed as 'CAPEC-63'); impact is bounded to versions before 3.0b63 of that unidentified Johnson Controls component.

This is a stored/reflected cross-site scripting flaw (CWE-79) with a reported CVSS 4.0 base score of 5.8 (Medium). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires low-level privileges (PR:L) - so the attacker must be authenticated. The 'E:P' exploit-maturity metric in the supplied vector signals that proof-of-concept exploit code exists; this is NOT the same as active exploitation. No CISA KEV listing and no EPSS score were provided, so widespread automated exploitation cannot be confirmed. Two signals conflict with the vector: the vector asserts UI:N (no user interaction), yet XSS realistically requires a victim to render the injected content, and the subsequent-system impacts (SC:H/SI:H/SA:H) look inflated for a typical XSS that executes in a victim's browser session - verify these with the vendor. Most critically, the product identity is corrupted: the affected 'product' is listed as 'CAPEC-63' (an attack-pattern catalog ID) and the CPE vendor is 'cwe-79_-_cross-site_scripting' (a weakness ID), neither of which is a real product or vendor. The reporter ('jci') and the sole reference (johnsoncontrols.com trust center) point to Johnson Controls, but the actual affected product cannot be determined from this data. Net assessment: a medium-severity, authenticated XSS with PoC code but no confirmed in-the-wild exploitation - a routine patch-prioritization item, not an emergency, pending resolution of the garbled product metadata.

An authenticated low-privilege user of the affected Johnson Controls web application submits input containing a crafted script payload into a field that is not properly neutralized before being rendered in a web page. When another user (potentially an administrator) views the page, the script executes in their browser session, enabling session hijacking or actions in their context. Proof-of-concept exploit code is indicated by the CVSS exploit-maturity metric (E:P).