Government Advisory

Security Flaw Found in Johnson Controls Metasys Building Management System

CISA · 13 Aug 2026

Key Takeaway If your business uses Johnson Controls Metasys or similar building management systems, check for vendor patches immediately and restrict access to management interfaces to trusted users only.

CISA has issued an advisory for a security vulnerability affecting Johnson Controls Metasys, a widely used building management system deployed across critical infrastructure sectors including manufacturing, commercial facilities, government, transportation, and energy.

The flaw, tracked as CVE-2026-34491, is a cross-site scripting (XSS) vulnerability that could allow a low-privilege user or attacker to inject a malicious payload via a crafted URL. This payload could then execute within other users' sessions, including administrators, potentially leading to session hijacking and unauthorised access to the system. The vulnerability affects Metasys versions 12 through 15 and has been rated 8.0 on the CVSS v3 severity scale, indicating a high level of risk.

While Metasys is primarily used in larger facility and infrastructure environments, small businesses that manage or rely on building automation systems—such as those in commercial property, hospitality, or facilities management—should be aware that vulnerabilities in these systems can be exploited to gain a foothold into broader networks. Organisations using affected versions should consult Johnson Controls and CISA's advisory for patching guidance and mitigation steps.

Johnson Controls Metasys CISA advisory cross-site scripting critical infrastructure

Summarised by CISO AI from CISA. We link back to every original so you can read it yourself.