CVE-2025-26385 is a command injection vulnerability (CWE-77) in Johnson Controls Metasys building-automation components that bundle Microsoft SQL Express — ADS, ADX, LCS8500, NAE8500, SCT and CCT — letting a remote, unauthenticated attacker execute arbitrary SQL Server commands and alter or destroy configuration and historical data; Johnson Controls' own CVSS v4.0 score is 9.5 (critical), but NVD has not, as of 2026-11-09, published its own Primary score, so this page is marked non-indexable pending that analysis.
Vulnerability summary
CVSS base score
9.5
Critical severity
EPSS score (FIRST)
1.5%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2025-26385 · Source: NVD (Johnson Controls Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Johnson Controls Metasys ADS/ADX/LCS8500/NAE8500 and SCT/CCT configuration tools (bundled SQL Express) | — | Metasys Application and Data Server (ADS) version 14.1 and prior; Extended ADS (ADX) version 14.1; LCS8500 and NAE8500 versions 12.0 through 14.1; System Configuration Tool (SCT) version 17.1 and prior; Controller Configuration Tool (CCT) version 17.0 and prior, per CISA ICSA-26-027-04 |
What does this mean for affected devices?
CVE-2025-26385 affects Metasys, Johnson Controls' flagship building-automation-system platform, specifically the components that bundle Microsoft SQL Express for local data storage: Application and Data Server (ADS), Extended ADS (ADX), LCS8500, NAE8500, System Configuration Tool (SCT) and Controller Configuration Tool (CCT). NVD's record describes the flaw as an "Improper Neutralization of Special Elements used in a Command (Command Injection)" vulnerability, noting that affected systems bundled with SQL Express are exposed to remote command injection (NVD).
The only CVSS metric NVD carries for this CVE is a Secondary score submitted by Johnson Controls' own product security team: CVSS v4.0 9.5 (critical), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — network-reachable, low attack complexity, requiring specific attack conditions but no privileges or user interaction, with high impact to confidentiality, integrity and availability of both the vulnerable system and subsequent systems it affects. As of this check, NVD has not published its own independent Primary CVSS score for CVE-2025-26385 (NVD).
The issue is documented in CISA's ICS advisory ICSA-26-027-04 ("Johnson Controls Metasys Products"), published 2026-01-27, which lists the affected products and version ranges as: Metasys ADS ≤14.1, ADX 14.1, LCS8500 and NAE8500 versions 12.0 through 14.1, SCT ≤17.1, and CCT ≤17.0, with a CVSS score of 10 (critical) under CISA's own scoring. CISA's advisory states Johnson Controls' recommended remediation is to download and install the Metasys patch for GIV-165989 from the Johnson Controls License Portal, combined with network segmentation per the Metasys Release 14 Hardening Guide and closing inbound access to TCP port 1433 (the SQL Server port) from untrusted networks (CISA ICSA-26-027-04). Johnson Controls also lists this advisory on its own security-advisories portal (Johnson Controls Security Advisories).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01475 (74.0th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Sites running the affected Metasys ADS/ADX, LCS8500, NAE8500, SCT or CCT builds should apply the GIV-165989 patch from the Johnson Controls License Portal, follow the Release 14 Hardening Guide for network segmentation, and block inbound TCP/1433 from untrusted networks until patched.
Evidence
- Command injection (CWE-77) vulnerability in Johnson Controls Metasys components bundled with Microsoft SQL Express, enabling remote unauthenticated SQL Server command execution. — NVD
- Only CVSS metric on record is a Johnson Controls Secondary score: CVSS v4.0 9.5 (critical), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. No NVD Primary score has been published as of this check. — NVD (Johnson Controls Secondary score only, not NVD Primary)
- CISA ICSA-26-027-04 (published 2026-01-27) lists affected products as Metasys ADS ≤14.1, ADX 14.1, LCS8500/NAE8500 12.0-14.1, SCT ≤17.1, CCT ≤17.0, scores the flaw 10 (critical), and recommends the GIV-165989 patch, Release 14 Hardening Guide segmentation, and closing TCP/1433 to untrusted networks. — CISA ICSA-26-027-04
- Johnson Controls lists this advisory on its own security-advisories portal. — Johnson Controls Security Advisories
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01475 (74.0th percentile) as of 2026-11-08. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What is CVE-2025-26385?
CVE-2025-26385 is a command injection vulnerability (CWE-77) in Johnson Controls Metasys building-automation components that bundle Microsoft SQL Express — ADS, ADX, LCS8500, NAE8500, SCT and CCT — letting a remote, unauthenticated attacker execute arbitrary SQL Server commands and alter or destroy configuration and historical data; Johnson Controls' own CVSS v4.0 score is 9.5 (critical), but NVD has not, as of 2026-11-09, published its own Primary score, so this page is marked non-indexable pending that analysis.
How severe is CVE-2025-26385?
NVD (Johnson Controls Secondary score only, not NVD Primary) scores CVE-2025-26385 9.5 out of 10 on the CVSS scale — a critical severity rating.
Is CVE-2025-26385 being actively exploited?
CVE-2025-26385 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 1.47%.
What is affected by CVE-2025-26385?
CVE-2025-26385 affects Johnson Controls Metasys ADS/ADX/LCS8500/NAE8500 and SCT/CCT configuration tools (bundled SQL Express).
Where does this CVE-2025-26385 information come from?
This advisory is based on NVD, CISA ICSA-26-027-04, Johnson Controls Security Advisories, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.
Questions about this page?