{"id":"CVE-2026-34491","title":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting.\n\nThis issue affects Metasys 14: before 14.1.5;…","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting.\n\nThis issue affects Metasys 14: before 14.1.5;…","severity":"none","cwe":["CWE-79"],"published":"2026-08-24","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34491","references":[{"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","label":"productsecurity@jci.com"}],"tags":["nvd"],"epss":0.00396,"epssPercentile":0.31959,"ingestedAt":"2026-10-14T13:30:58.564Z","slug":"CVE-2026-34491","body":"## Overview\n\nImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting.\n\nThis issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}