Stored XSS

Johnson Controls Metasys Building Automation Flaw Enables Administrative Session Hijacking CVE-2026-34491

CISA ICS Advisory ICSA-26-225-14 warns of a high-severity stored XSS defect in Johnson Controls Metasys building automation systems risking administrative takeover.