CVE-2025-26385CWE-77

Metasys product command injection vulnerability could allow remote SQL execution

Critical · published January 30, 2026

CVSS v4.0
9.5
EPSS
1%
Percentile
74.0
In the wild
Unconfirmed
What it is

Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects

* Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation,

* Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation,

* LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1,

* System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior,

* Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior.

The record
Technical detail
CVSS v4.0
9.5 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01497 · 74.0th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-01-30T11:05Z
EPSS history
Timeline
  • 30 JAN 11:05Z
    Metasys product command injection vulnerability could allow remote SQL execution
    cvelistv5