Johnson Controls Metasys
4 CVEs affecting Johnson Controls Metasys. Latest disclosed: 2026-01-30. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27657 | High | 8.8 | 2021-06-04 | Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them t… |
CVE-2021-36202 | High | 8.4 | 2022-04-07 | Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF ex… |
CVE-2021-36205 | High | 8.1 | 2022-04-15 | Under certain circumstances the session token is not cleared on logout. |
CVE-2025-26385 | | 2026-01-30 | Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Success… |