CVE-2026-34491
EUVD-2026-6500524.08.2026, 18:17
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting.
This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.EnginsightAwaiting analysis
This vulnerability is currently awaiting analysis.