CISA ICSA-26-225-14: Johnson Controls Metasys Building Automation Vulnerability — Detection and Hardening Guide

CISA has published ICS advisory ICSA-26-225-14 covering vulnerabilities in the Johnson Controls Metasys building automation system (BAS). Metasys is not a niche product — it is one of the most widely deployed building management platforms in the world, running HVAC, lighting, access control, and life-safety integration across hospitals, data centers, airports, universities, and commercial real estate. When CISA publishes an ICS advisory for a product in this class, it means the vendor has coordinated disclosure and there is a real, patchable defect that operators need to address on OT infrastructure that is frequently years behind on maintenance windows.

The urgency here is not abstract. Building automation systems have been used as initial access vectors and lateral movement springboards in documented intrusions precisely because they sit at the intersection of IT and OT networks, are managed by facilities teams rather than security teams, and often expose web interfaces, BACnet services, and remote vendor access paths that nobody has inventoried. A vulnerability in Metasys is a vulnerability in the physical environment of your organization — temperature control in a data center, air handling in a hospital, access control in a secure facility.

This post breaks down what defenders need to know about ICSA-26-225-14, how to assess exposure, what to hunt for while you patch, and how to harden Metasys deployments against the exploitation patterns we consistently see against BAS platforms.

Technical Analysis

What the Advisory Covers

ICSA-26-225-14 addresses vulnerabilities in the Johnson Controls Metasys product family. Per CISA's standard ICS advisory format, the advisory identifies affected Metasys components and versions, assigns CVE identifiers and CVSS scores, and — critically — notes whether the affected products are deployed globally across the critical manufacturing, commercial facilities, healthcare, and government facilities sectors. The full technical detail, including exact affected version ranges, CVE identifiers, CVSS vectors, and the researcher's disclosure timeline, is published at the source advisory:

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-14

Do not guess at your exposure. Pull the advisory, extract the affected product list and version ranges, and diff them against your actual inventory. The Metasys product family spans multiple components with separate versioning:

• Metasys Application and Data Server (ADS) and Extended Application and Data Server (ADX) — the Windows-based supervisory servers that host the Site Management Portal (SMP) web UI, Metasys UI, historical trending, and alarm management.
• Network Control Engines (NCE) and Network Automation Engines (NAE) — the embedded supervisory controllers that bridge IP networks to field buses (BACnet MS/TP, N2, Modbus, LonWorks) and run the site logic.
• Metasys Server components — including the web services, SQL-backed databases, and API surfaces that integrators and remote monitoring tools connect to.
• Field controllers (CGx, FEC, FAC families in modern releases) — typically downstream of the engines but reachable through them.

Why BAS Vulnerabilities Are High-Value Targets

From a defender's perspective, the exploitation model against Metasys-class platforms is well established:

1. Discovery. Internet-facing ADS/ADX web interfaces (Site Management Portal, Metasys UI) are trivially fingerprintable. Shodan and Censys return Metasys instances by the thousands. Even when not internet-exposed, engines are routinely reachable from flat corporate networks because BAS networks were never segmented.
2. Initial access. Web application flaws, weak/default credentials on the SMP, exposed API endpoints, or unpatched Windows services on the ADS host provide the foothold. Engines historically ship with vendor service accounts and documented default credentials that facilities contractors never rotate.
3. OT pivot. Once on an ADS/ADX or an engine, the attacker controls a trusted device that legitimately speaks BACnet/IP (UDP 47808), can write to field controllers, and can issue commands to physical equipment. From the engine, they can also pivot back into IT — the ADS is a domain-joined Windows box in many environments.
4. Impact. Manipulation of setpoints, disabling of alarms, overriding of schedules, destruction of trend/historian data, or ransomware detonated on the Windows-based server tier — which is exactly what happened in the 2023 Johnson Controls ransomware incident that disrupted the company's own internal systems and exposed data.

Exploitation Status

As with most coordinated ICS disclosures, CISA advisories typically note that there is no known public exploitation specifically targeting these vulnerabilities at time of publication — but that status changes fast once an advisory is public. ICS advisories function as exploit roadmaps: they name the product, the component, the weakness class, and the fixed versions. Treat publication day as the start of a race condition. If this advisory lands on the CISA Known Exploited Vulnerabilities (KEV) catalog or a public PoC surfaces, your remediation window collapses from weeks to days. Monitor both the advisory page for updates and the KEV catalog.

Detection & Response

This is a technical ICS advisory, so detection content follows. The honest caveat up front: the highest-fidelity detections for Metasys abuse are network- and identity-based, because the engines themselves are embedded devices with no EDR story. Your visibility lives on the Windows ADS/ADX hosts, your network sensors, and your identity layer. Write detections there.

Sigma Rules

The following rules target the most reliable observable behaviors: abuse of the Windows server tier hosting Metasys, anomalous authentication to Metasys web interfaces, and suspicious process execution originating from Metasys service accounts or install paths. Tune the paths and account names to your deployment before enabling at high level.

---
title: Suspicious Process Execution from Metasys Server Service Context
id: 3f8c1a72-6d44-4e91-b2a7-9c5e0d1f8a33
status: experimental
description: Detects command shells, scripting engines, or reconnaissance utilities spawned by Metasys ADS/ADX service processes or from Metasys installation directories. Legitimate Metasys services do not spawn cmd, PowerShell, or system utilities under normal operation; this behavior is consistent with post-exploitation on a compromised building automation server.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-14
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Metasys\'
      - '\Johnson Controls\'
      - '\Program Files (x86)\Johnson Controls\'
  selection_image:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_image
falsepositives:
  - Vendor maintenance scripts executed by Johnson Controls support during scheduled service windows
  - BAS integrator commissioning tools
level: high
---
title: Anomalous Authentication to Metasys Site Management Portal
id: 91b2e4d8-3c7a-4f56-a8e1-2d9b0c4f7e15
status: experimental
description: Detects successful authentication events to Windows systems hosting Metasys ADS/ADX originating from unusual source addresses, including non-facilities subnets, VPN pools, or external addresses. Metasys supervisory servers should only receive interactive and network logons from a small, known set of jump hosts and integrator systems.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-14
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1078
logsource:
  product: windows
  service: security
detection:
  selection:
    LogonType:
      - 2
      - 3
      - 10
    Computer|contains:
      - 'ADS'
      - 'ADX'
      - 'METASYS'
  filter_known_sources:
    IpAddress|startswith:
      - '10.10.50.'
      - '10.10.51.'
  condition: selection and not filter_known_sources
falsepositives:
  - Facilities team access from newly provisioned subnets not yet in allowlist
  - Legitimate vendor remote access that bypasses the designated jump host
level: medium
---
title: Local Account Creation or Group Modification on Metasys Server Hosts
id: c47d92f1-8b35-4a60-9d2e-5f1a3b8c6e94
status: experimental
description: Detects creation of new local user accounts or modification of local Administrators group membership on hosts identified as Metasys ADS/ADX servers. Attackers who compromise BAS servers frequently establish local persistence accounts to survive domain credential resets and Metasys application-level password changes.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-14
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  product: windows
  service: security
detection:
  selection:
    Computer|contains:
      - 'ADS'
      - 'ADX'
      - 'METASYS'
  condition: selection
falsepositives:
  - Johnson Controls service accounts provisioned during upgrade or commissioning
  - Scheduled vendor maintenance creating temporary accounts
level: high

A note on the second and third rules: they rely on a host naming convention filter (ADS, ADX, METASYS). Replace that with your actual server inventory or, better, a watchlist lookup. These rules exist because account activity on BAS servers is low-volume and well-bounded — a new local admin on a Metasys server is almost never routine.

KQL — Microsoft Sentinel / Defender

This hunt query looks for authentication anomalies and suspicious process lineage against hosts running Metasys services. It assumes you have Defender for Endpoint deployed on the ADS/ADX Windows servers (you should — they are Windows boxes, not OT embedded devices) and/or Sysmon/Security Event ingestion into Sentinel. For the network layer, it includes a BACnet segment using CommonSecurityLog for environments ingesting firewall/IDS telemetry.

// Hunt 1: Suspicious process execution on Metasys ADS/ADX hosts
// Deploy Defender for Endpoint on BAS Windows servers; scope to your Metasys host list
let MetasysHosts = dynamic(["ADS01", "ADX01", "METASYS-SVR"]); // Replace with actual inventory or use a watchlist
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe", "net.exe", "whoami.exe", "certutil.exe", "bitsadmin.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where DeviceName has_any (MetasysHosts)
| where FileName in~ (SuspiciousChildren)
| where InitiatingProcessFolderPath has_any ("Metasys", "Johnson Controls")
     or InitiatingProcessAccountName has_any ("metasys", "jci", "bacnet")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc;

// Hunt 2: Network authentication to Metasys hosts from non-allowlisted sources
let AllowedSources = dynamic(["10.10.50.0/24", "10.10.51.0/24"]); // Facilities/integrator jump subnets
SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 4624
| where LogonType in (3, 10)
| where Computer has_any (MetasysHosts)
| where not (ipv4_is_in_any_range(IpAddress, AllowedSources))
| where IpAddress != "-" and IpAddress != "::1"
| summarize LogonCount = count(), DistinctAccounts = dcount(Account), Accounts = make_set(Account)
  by Computer, IpAddress, LogonType, bin(TimeGenerated, 1d)
| order by TimeGenerated desc;

// Hunt 3: BACnet/IP traffic crossing zone boundaries (requires firewall/IDS CEF ingestion)
// BACnet/IP uses UDP 47808; it should never traverse IT/OT zone boundaries to non-BAS destinations
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort == 47808
| where DeviceAction in ("Allow", "allow", "Permit")
| summarize ConnectionCount = count(), Sources = make_set(SourceIP) by DestinationIP, DeviceName, bin(TimeGenerated, 1h)
| order by ConnectionCount desc;

The BACnet query is the one most environments are missing. BACnet write-property and device-communication traffic appearing on your enterprise firewall — especially sourced from IT subnets toward OT segments, or worse, from VPN or external addresses — is a high-signal event. Baseline what legitimate BACnet/IP flows look like (engine-to-ADS, ADS-to-engine, integrator workstation sessions) and alert on deviation.

Velociraptor VQL

For endpoint forensics on a suspected-compromised ADS/ADX host, this artifact triages processes running from Metasys directories with suspicious command lines, enumerates local accounts for persistence, and checks network listeners on the BAS ports (80/443 for SMP, 47808 for BACnet/IP, plus the Metasys-specific service ports in the 10250+ range used by ADS/ADX communications).

-- Security Arsenal: Metasys ADS/ADX compromise triage
-- Run against Windows hosts identified as Metasys supervisory servers
-- Reference: CISA ICSA-26-225-14

-- Part 1: Processes executing from Metasys paths with suspicious lineage or command lines
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Exe =~ '(?i)Metasys|Johnson Controls'
   AND CommandLine =~ '(?i)powershell|cmd\.exe|certutil|bitsadmin|rundll32|mshta|-enc|-nop|downloadstring|invoke-')
   OR (Username =~ '(?i)metasys|jci|local service|network service'
   AND Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|net\.exe')

-- Part 2: Network listeners on BAS-relevant ports (BACnet/IP, SMP web, Metasys services)
SELECT Pid, Name, Path, Family, Type, LocalIP, LocalPort, RemoteIP, RemotePort, State, Process.Username AS ListenerUser
FROM netstat()
WHERE LocalPort in (47808, 80, 443, 10250, 10251, 10252, 1433)
   AND State =~ 'LISTEN'

-- Part 3: Recently created or modified files in Metasys web root (web shell triage)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Program Files*/Johnson Controls/**/*.aspx')
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

The third section is your web shell sweep. If an attacker exploited a web-facing flaw in the Site Management Portal or Metasys UI, the durable follow-on move is a dropped ASPX shell in the web root. Any ASPX file modified within your incident window that is not attributable to a documented vendor patch or upgrade is a lead.

Verification Script

Use this PowerShell script on ADS/ADX hosts to snapshot the current security posture: installed Metasys components and versions (for comparison against the advisory's affected version list), local accounts, listening BAS ports, and recently modified web content.

# Security Arsenal - Metasys ADS/ADX posture verification
# Reference: CISA ICSA-26-225-14
# Run elevated on each Metasys supervisory server

Write-Output "===== Installed Johnson Controls / Metasys Components ====="
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
                 HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Where-Object { $_.DisplayName -match 'Metasys|Johnson Controls' } |
    Select-Object DisplayName, DisplayVersion, InstallDate |
    Format-Table -AutoSize
# ACTION: Compare DisplayVersion output against the affected version ranges in ICSA-26-225-14

Write-Output "===== Local User Accounts (persistence check) ====="
Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet | Format-Table -AutoSize
Get-LocalGroupMember -Group 'Administrators' | Format-Table -AutoSize
# ACTION: Every account must be attributable. Investigate anything not in your provisioning records.

Write-Output "===== Listening Ports: BAS and Web Services ====="
Get-NetTCPConnection -State Listen |
    Where-Object { $_.LocalPort -in 80,443,1433,10250,10251,10252 } |
    Select-Object LocalAddress, LocalPort, OwningProcess,
        @{N='ProcessName';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name}} |
    Format-Table -AutoSize

Write-Output "===== BACnet/IP (UDP 47808) listeners ====="
Get-NetUDPEndpoint -LocalPort 47808 -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, OwningProcess | Format-Table -AutoSize

Write-Output "===== Recently Modified Web Content (last 14 days) ====="
$webRoots = @('C:\Program Files\Johnson Controls','C:\Program Files (x86)\Johnson Controls','C:\inetpub')
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.ashx,*.asmx,*.config -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
            Select-Object FullName, LastWriteTime | Format-Table -AutoSize
    }
}

Write-Output "===== Windows Update / Patch Level ====="
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 |
    Select-Object HotFixID, InstalledOn, Description | Format-Table -AutoSize

Remediation

1. Pull the advisory and build your affected inventory today. Download ICSA-26-225-14 from https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-14. Extract the affected products and version ranges. Enumerate every Metasys ADS, ADX, NAE, and NCE in your environment — including the ones facilities manages that IT doesn't know about. Version data is in the Metasys UI under system configuration and in Add/Remove Programs on the server tier (the verification script above pulls it).

2. Patch to the vendor-fixed versions. Johnson Controls publishes corrected releases and upgrade paths through its Product Security portal and directly via CISA's advisory. Coordinate maintenance windows with facilities now — BAS patch windows are historically hard to schedule, which is exactly why these systems run vulnerable for years. If your Metasys version is end-of-support and no patch exists for your branch, that is a forced-migration conversation, not a risk-acceptance conversation.

3. If you cannot patch immediately, compensate:

• Remove any internet exposure of Metasys web interfaces. Search Shodan/Censys for your public ranges now. There is no legitimate reason for an SMP or Metasys UI to be internet-reachable; remote access belongs behind a hardened jump host with MFA.
• Segment the BAS network. Metasys engines and servers should sit on dedicated VLANs/VRFs with ACLs permitting only required flows: ADS/ADX to engines, operator workstations to ADS/ADX, and integrator access through a controlled jump box. Block BACnet/IP (UDP 47808) at every zone boundary except where explicitly engineered.
• Enforce credential hygiene. Rotate default and shared credentials on engines and the SMP, disable unused vendor service accounts, and integrate Metasys authentication with your directory/IdP where supported so accounts die when employees and contractors leave.
• Constrain remote vendor access. Integrator and Johnson Controls support access should be brokered through your remote access solution (PAM/jump host), time-boxed, logged, and monitored — not standing VPN accounts.

4. Patch and harden the underlying Windows tier. The ADS/ADX is a Windows server running IIS and SQL Server. It inherits every OS and platform vulnerability in addition to the Metasys application flaws. Bring it into your standard patch cadence, deploy EDR (it supports it — these are standard Windows builds), and apply CIS benchmark hardening.

5. Deploy the detections above and baseline BACnet traffic. Even after patching, these hunts give you durable visibility into the BAS attack surface that most SOCs simply do not have today.

6. Track the advisory for updates. CISA revises ICS advisories when exploitation is confirmed or mitigations change. If any CVE from this advisory is added to the KEV catalog, federal civilian agencies face binding remediation deadlines under BOD 22-01 — and you should treat that clock as your own regardless of sector.

Final Assessment

Building automation is the soft underbelly of enterprise security: physically consequential, operationally fragile, rarely inventoried, and almost never monitored. ICSA-26-225-14 is a routine coordinated disclosure on paper, but the class of asset it touches is anything but routine. The organizations that handle this well will do three things: know exactly where their Metasys assets are, patch on a defined timeline instead of an indefinite one, and finally put detective controls around a network segment that has been blind to security tooling since the day it was commissioned.

Related Resources

Security Arsenal Alert Triage Automation AlertMonitor Platform Book a SOC Assessment platform Intel Hub