Metasys 12, 15 persistent XSS hijacks admin sessions at CVSS 8.0

CISA published ICSA-26-225-14 on August 13, disclosing CVE-2026-34491, a persistent cross-site scripting vulnerability in Johnson Controls Metasys versions 12 through 15. The CVSS 3.1 score lands at 8.0 (HIGH), with the CVSS 4.0 score at 8.6. The vector tells the story: network-exploitable, low attack complexity, low privileges required, and scope unchanged, meaning the injected script executes with the full privileges of whichever user's session it runs in, including administrators.

The vulnerability works through a crafted URL. A low-privilege user injects a payload that persists across logins. When an administrator visits the poisoned page, the payload executes in the admin's browser context. Session hijacking and admin-account takeover follow. The attack needs user interaction (someone has to click the link) but in a building automation system where operators routinely navigate dashboards and alarm panels, that's not much of a barrier.

The patch matrix leaves operators with uncomfortable math

Johnson Controls patched Metasys 15.0 on March 25, 2026 (users should apply 15.0.1). Metasys 16.0 shipped fixed. But versions 12 and 13 are end-of-support, no patch is coming, and the only remediation path is a full version upgrade. Metasys 14.1.5 has a forecast release of July 15, 2026, a date Johnson Controls describes as a forecast, not a commitment. Organizations running Metasys 14.1 in production are waiting on a patch with no binding delivery date, while organizations on 12 or 13 have already been told the clock ran out.

This isn't the first time. ICSA-22-165-01 (June 2022) covered stored XSS in Metasys versions 10 and 11 at CVSS 8.7. The recurrence of the same weakness class across product generations suggests a pattern, not an isolated oversight.

Building automation doesn't get the web-app scrutiny it needs

Metasys runs in critical manufacturing, commercial facilities, government services, transportation systems, and energy, sectors where building automation systems control HVAC, lighting, fire suppression, and physical access. These systems are often treated as operational technology and segregated from IT networks, but the Metasys UI is a web application. Persistent XSS with admin-context execution isn't just a web-tier nuisance in this environment; it's a credential-theft vector that can give an attacker a foothold from which to pivot deeper into OT networks.

Johnson Controls recommends network segmentation and advises against exposing the Metasys UI to the internet, sound practices. But the advisory also suggests implementing Content Security Policy headers and deploying a web application firewall, mitigations that operate at the network or proxy layer and may not catch every XSS variant, particularly those encoded to evade signature-based detection. CSP and WAF are compensations, not fixes. The underlying code flaw (improper neutralization of input during web page generation) remains until the patch is applied.

Patching now, waiting, or migrating, it depends on your version

If you're running Metasys 15.0, apply 15.0.1 now. If you're on 14.1, you have an interim problem: the patch is forecast but undated, so your Monday move is to verify that the Metasys UI is not internet-accessible, restrict access to trusted networks, implement CSP headers at the proxy level, and monitor UI access logs for suspicious URL patterns. If you're on 12 or 13, the path is a version upgrade (Johnson Controls isn't shipping a fix) and that's a migration project, not a patch cycle. Start the planning now, because the vulnerability is disclosed, the CVSS is 8.0, and the attacker's job just got easier.