CVE-2026-34491

MediumCVSS 6.1/10Last modified Oct 14, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting.

This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

Metrics

CVSS 4.0 6.1/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Johnson ControlsMetasys 14< 14.1.5
Johnson ControlsMetasys 15< 15.0.1

References

Timeline

Published
Aug 24, 2026
Last modified
Oct 14, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-344927.0External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: befCVE-2026-344937.2- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affeCVE-2026-344947.2- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue CVE-2026-344955.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee aCVE-2026-344967.1Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1.CVE-2026-344975.4Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows CCVE-2026-344985.1Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issuCVE-2026-344998.5Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issuCVE-2026-345006.5CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This iCVE-2026-345017.5Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime UtilitCVE-2026-345027.5Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime UtiCVE-2026-345038.1OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revok