ME
Product
Metasys
by Johnson Controls · last CVE Jan 30, 2026
1
CVEs
0
On KEV
9.5
Max CVSS
0
New 30D
Severity mix
Critical 1High 0Medium 0Low 0
Watch

Add Metasys to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-26385
9.5
1%
Jan 30
Metasys product command injection vulnerability could allow remote SQL execution
Affected: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation; Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation; LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1; System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior; Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior
Showing 1