A Metasys XSS That Waits for the Administrator to Log In

CISA has published advisory ICSA-26-225-14 covering a stored cross-site scripting flaw in Johnson Controls Metasys, in which a low-privilege user injects a payload into the Metasys UI through a crafted URL ^[1][2]. The payload persists across logins and executes in the browser context of other users, administrators included, which is what separates this from the usual reflected-XSS filler in an ICS advisory ^[2].

CISA's stated outcome is session hijacking and unauthorized access ^[3]. The mechanics matter more than the label: the precondition is an account that already exists inside the building automation system, and the effect is code running in an administrator's session on a building management platform. The trust boundary between an operator who can adjust a setpoint and an operator who can reconfigure the system is doing no work here. The advisory classifies the issue as CWE-79 ^[4], and it was reported to Johnson Controls by an anonymous researcher ^[5].

The version matrix is where the operational problem sits. Metasys 12 and 13 are affected in all versions and are both listed as end of support, with the remediation given as "update to later version" ^[6][7]. Metasys 14 is affected below 14.1.5, and Metasys 15 below 15.0.1 ^[6]. The 15.0 patch shipped on 25 March 2026; 14.1.5 carries a forecast release date of 15 July 2026 ^[8][9]. That is 112 days during which sites on the 14 train have a documented escalation path and no vendor fix ^[10]. Metasys 16.0 was fixed before release and is not impacted ^[11]. Anything at 11 or earlier is not affected, because the defect was introduced at version 12 ^[12].

So two of the four affected trains get no patch at all, only a migration project ^[13]. For building operators, that is a capital and downtime conversation, not a maintenance window.

The interim guidance is the standard stack: keep the Metasys UI on trusted networks and off the internet, segment building automation from corporate IT, enforce least privilege, add Content Security Policy and other HTTP security headers at the network or proxy layer, monitor access logs for suspicious URL patterns and unexpected script execution, put a WAF in front of the UI, and tell users not to click unexpected Metasys links ^[14]. CISA repeats its usual controls-network advice about firewalls, isolation from business networks and VPNs for remote access, with the caveat that a VPN is only as secure as the device connected to it ^[15]. Two of those items are weaker than they look for this bug. Least privilege limits blast radius but does not remove the precondition, since a low-privilege account is all the attacker needs ^[2]. Network isolation does not help if the hostile account is already an internal one.

Worth watching: whether 14.1.5 actually lands on 15 July ^[9]; whether the CVE coverage gets tidied up, since CVE-2026-34491 is attached only to Metasys 12 and 13 in the advisory while 14 and 15 are listed as affected without an identifier ^[16][6]; and whether a CVSS score appears, because the advisory's metrics section is empty ^[17]. Johnson Controls' own advisory, JCI-PSA-2026-11, is the place to check for fix detail ^[18]. Metasys is deployed worldwide across critical manufacturing, commercial facilities, government facilities, transportation and energy ^[19].