SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-34491

MEDIUM · CVSS 6.1 EPSS 0.29%

Source: NVD + CISA KEV + EPSS · Published 2026-08-24 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

Johnson Controls Metasys versions 14 (prior to 14.1.5) and 15 (prior to 15.0.1) are vulnerable to cross-site scripting due to improper input handling during web page generation. This flaw could allow attackers to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized actions or data exposure. Organizations using these versions should prioritize patching to mitigate the risk of exploitation.

CVE
CVE-2026-34491
Severity
MEDIUM
CVSS
6.1
EPSS
0.29%

Original NVD Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.