Advisories · Technology

Johnson Controls Metasys.

Every CVE that names Johnson Controls Metasys among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-26385 CVE record

CVSS 9.5 CriticalCritical · CVSS 9+

Metasys product command injection vulnerability could allow remote SQL execution
- Johnson Controls Metasys
- Command injection
Not analysed yet 30 Jan 2026
CVE-2021-36205 CVE record

CVSS 8.1 High

Metasys session token
- Johnson Controls Metasys
- CWE-459
Not analysed yet 15 Apr 2022
CVE-2021-36202 CVE record

CVSS 8.4 High

Metasys UI
- Johnson Controls Metasys
- Server-side request forgery (SSRF)
Not analysed yet 7 Apr 2022
CVE-2021-27657 CVE record

CVSS 8.8 High

Metasys Improper Privilege Management
- Johnson Controls Metasys
- Privilege escalation
Not analysed yet 4 Jun 2021