CVE-2025-26385 Metasys product command injection vulnerability could allow remote SQL execution
Remote attackers can execute arbitrary SQL commands via command injection in Johnson Controls Metasys building automation systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-26385?
CVE-2025-26385 is a critical command injection vulnerability in Johnson Controls Metasys, published on 30 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects
* Metasys: Application and Data Server (ADS) installed with SQL Express deployed as part of the Metasys 14.1 and prior installation, * Extended Application and Data Server (ADX) installed with SQL Express deployed as part of the Metasys 14.1 installation, * LCS8500 or NAE8500 installed with SQL Express deployed as part of the Metasys installation Releases 12.0 through 14.1, * System Configuration Tool (SCT) installed with SQL Express deployed as part of the SCT installation 17.1 and prior, * Controller Configuration Tool (CCT) installed with SQL Express deployed as part of the CCT installation 17.0 and prior.
Weakness: CWE-77
Which versions are affected by CVE-2025-26385?
How do I fix CVE-2025-26385?
No fix has been published for CVE-2025-26385 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-26385 being exploited?
There is no known exploitation of CVE-2025-26385 in the wild and no public exploit code.
Sources
Also known as GHSA-r8f6-f62h-4px7.