Vulnerability · Published Jan 30, 2026 · Assigned by jci
CVE-2025-26385Metasys product command injection vulnerability could allow remote SQL execution
Critical 9.5
In plain English
A critical-severity command injection in Metasys from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Official description
Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects * Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation, * Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation, * LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1, * System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior, * Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | Metasys | Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installationExtended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installationLCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and priorController Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior |
Weakness: CWE-77 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H