CVE-2026-34491 Overview
CVE-2026-34491 is a stored/reflected cross-site scripting (XSS) vulnerability affecting Johnson Controls Metasys building automation systems. The flaw resides in the web interface, which fails to properly neutralize user-supplied input during web page generation. An authenticated attacker with low privileges can inject malicious script content that executes in another user's browser session.
The issue affects Metasys 14 versions before 14.1.5 and Metasys 15 versions before 15.0.1. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Successful exploitation allows script execution in an authenticated operator's browser, enabling session theft, credential harvesting, or unauthorized actions against the building automation system.
Affected Products
- Johnson Controls Metasys 14 (versions before 14.1.5)
- Johnson Controls Metasys 15 (versions before 15.0.1)
- Metasys web-based management interfaces
Discovery Timeline
- 2026-08-24 - CVE-2026-34491 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-34491
Vulnerability Analysis
The vulnerability stems from improper neutralization of input during web page generation within the Metasys web interface. When the application renders user-supplied data back into HTML responses, it does not adequately encode or sanitize characters that carry meaning in HTML, JavaScript, or attribute contexts.
An attacker with valid low-privilege credentials can submit crafted input containing script payloads. When another user, typically a higher-privileged operator, loads the affected page, the injected script executes in the context of that user's authenticated session.
Exploitation requires user interaction. The impact scope is bound to the vulnerable Metasys application and does not directly cross into other systems, though session hijacking can lead to further compromise of building control functions.
Root Cause
The root cause is missing or insufficient output encoding when reflecting user-controlled input into generated HTML. The application accepts input from authenticated users and stores or reflects it without applying context-appropriate escaping for HTML entities, JavaScript strings, or DOM attributes.
Attack Vector
The attack is network-based and requires low privileges plus user interaction. An authenticated attacker submits a crafted payload through a Metasys input field or URL parameter. A victim user then views the affected content and executes the attacker's JavaScript within their browser session, granting the attacker access to cookies, tokens, and application actions available to the victim.
No verified public exploit code is available at this time. For technical details, refer to the Johnson Controls Security Advisory.
Detection Methods for CVE-2026-34491
Indicators of Compromise
- Unexpected <script> tags, JavaScript event handlers, or encoded payloads stored in Metasys configuration fields, labels, or user-supplied names.
- Outbound HTTP requests from operator workstations to unfamiliar domains shortly after loading Metasys pages.
- Anomalous Metasys session activity such as API calls originating from operator sessions without corresponding user actions.
Detection Strategies
- Review Metasys web server access logs for query parameters and POST bodies containing HTML control characters such as <, >, ", or JavaScript keywords like onerror, onload, and javascript:.
- Inspect stored Metasys objects, alarm messages, and object descriptors for embedded HTML or script content.
- Correlate authentication events with subsequent administrative actions to identify session-riding behavior.
Monitoring Recommendations
- Deploy web application firewall rules that flag XSS patterns targeting Metasys web endpoints.
- Monitor operator workstation browsers for unusual DOM modifications or script execution when connected to Metasys.
- Alert on Metasys account activity from unexpected IP addresses or during off-hours maintenance windows.
How to Mitigate CVE-2026-34491
Immediate Actions Required
- Upgrade Metasys 14 deployments to version 14.1.5 or later.
- Upgrade Metasys 15 deployments to version 15.0.1 or later.
- Restrict Metasys web interface access to trusted management networks and enforce least-privilege role assignments.
- Audit existing Metasys accounts and remove unused or over-permissioned users.
Patch Information
Johnson Controls has released fixed builds in Metasys 14.1.5 and Metasys 15.0.1. Refer to the Johnson Controls Security Advisory portal for download links, release notes, and supporting guidance specific to your deployment.
Workarounds
- Place the Metasys web interface behind a VPN or bastion host to limit exposure to authenticated attackers.
- Enforce network segmentation between operational technology (OT) building systems and general enterprise IT networks.
- Require multi-factor authentication (MFA) on identity providers used to access Metasys operator accounts.
- Instruct operators to log out of Metasys sessions when not in active use to shorten the exploit window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
