Critical Command Injection Vulnerability in Johnson Controls Metasys (CVE-2025-26385)
Executive Summary
In January 2026, a critical command injection vulnerability (CVE-2025-26385) was identified in Johnson Controls' Metasys building automation system. This flaw allowed unauthenticated remote attackers to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of affected systems. The vulnerability impacted multiple Metasys components, including the Application and Data Server (ADS), Extended Application and Data Server (ADX), and various tools integrated with SQL Express, across versions 12.0 through 14.1. Johnson Controls promptly released patches and provided mitigation strategies to address the issue.
This incident underscores the importance of securing building automation systems, especially as they become increasingly interconnected. Organizations are urged to apply the latest patches, follow vendor-recommended hardening guidelines, and implement network segmentation to protect critical infrastructure from similar vulnerabilities.
Why This Matters Now
The CVE-2025-26385 vulnerability highlights the critical need for robust security measures in building automation systems, which are integral to modern infrastructure. As these systems become more interconnected, they present attractive targets for cyber attackers. Ensuring timely patching, network segmentation, and adherence to security best practices is essential to safeguard against potential exploits that could disrupt operations and compromise sensitive data.
Attack Path Analysis
An attacker exploited a cross-site scripting (XSS) vulnerability in the Johnson Controls Metasys web application by crafting a malicious URL that, when accessed by other users, executed unauthorized scripts in their browser sessions. This allowed the attacker to hijack user sessions, including those of administrators, leading to unauthorized access and potential data manipulation. The attacker then escalated privileges by leveraging the compromised administrator sessions to gain higher-level access within the Metasys system. Utilizing the elevated privileges, the attacker moved laterally across the network to access other connected systems and devices. The attacker established a command and control channel to maintain persistent access and control over the compromised systems. Sensitive data was exfiltrated from the Metasys system to an external server controlled by the attacker. The attack culminated in the disruption of building management operations, potentially affecting critical infrastructure services.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
An attacker exploited a cross-site scripting (XSS) vulnerability in the Johnson Controls Metasys web application by crafting a malicious URL that, when accessed by other users, executed unauthorized scripts in their browser sessions.
Related CVEs
CVE-2026-34491
CVSS 8A low-privilege user can inject a malicious XSS payload into the Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators.
Affected Products:
Johnson Controls Inc Metasys – 12: all versions, 13: all versions, 14: versions prior to 14.1.5, 15: versions prior to 15.0.1
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
JavaScript
Exploit Public-Facing Application
Valid Accounts
Bypass User Account Control
Web Protocols
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Input Validation
Control ID: 6.5.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Application Security
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
Johnson Controls Metasys XSS vulnerability threatens HVAC controls in hospitals, risking patient safety through compromised environmental systems and HIPAA compliance violations.
Government Administration
Cross-site scripting in building automation systems exposes government facilities to session hijacking attacks, compromising critical infrastructure security and administrative operations.
Higher Education/Acadamia
Metasys web application vulnerability enables persistent XSS attacks on campus building systems, allowing unauthorized access to HVAC controls across educational facilities.
Commercial Real Estate
Building automation system XSS vulnerability allows attackers to hijack administrative sessions, potentially disrupting tenant HVAC services and facility management operations.
Sources
- Johnson Controls Metasyshttps://www.cisa.gov/news-events/ics-advisories/icsa-26-225-14Verified
- Johnson Controls Metasys Security Advisoryhttps://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisoriesVerified
- Johnson Controls launches Metasys 16.0 to support high-performance environments where uptime and resilience are criticalhttps://www.johnsoncontrols.com/media-center/news/press-releases/2026/06/29/johnson-controls-launches-metasys-16Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant to this incident as it could have constrained the attacker's ability to escalate privileges, move laterally, and exfiltrate data by enforcing strict segmentation and access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit the XSS vulnerability may have been limited by enforcing strict access controls and input validation, reducing the likelihood of unauthorized script execution.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges could have been constrained by enforcing strict identity-based access controls, reducing unauthorized access to sensitive resources.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement could have been constrained by enforcing east-west traffic controls, reducing unauthorized access to other systems.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels could have been constrained by enforcing strict monitoring and control over network traffic, reducing unauthorized communications.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate data could have been constrained by enforcing strict egress policies, reducing unauthorized data transfers.
The attacker's ability to disrupt building management operations could have been constrained by enforcing strict access controls and segmentation, reducing unauthorized access to critical systems.
Impact at a Glance
Affected Business Functions
- Building Automation Control
- Energy Management
- HVAC System Monitoring
- Security System Integration
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of building automation system configurations and user credentials.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Content Security Policy (CSP) headers to mitigate XSS vulnerabilities.
- • Enforce least-privilege access controls to limit user permissions.
- • Utilize web application firewalls (WAFs) to detect and block malicious payloads.
- • Monitor for suspicious URL patterns and unexpected script execution in access logs.
- • Educate users to avoid clicking on untrusted or unexpected links targeting the Metasys UI.
