[Control Systems] Johnson Controls security advisory (AV26-837)
Brief
Serial Number: AV26-837
Date: August 19, 2026
As of August 13, 2026, Johnson Controls is affected by vulnerabilities in the following products:
- Airwall
- Prior to 4.1.0
- Metasys 12
- all versions
- Metasys 13
- all versions
- Metasys 14
- all versions prior to v14.1.5
- Metasys 15
- all versions prior to v15.0.1
- TL280
- Prior to v5.62
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
- Johnson Controls - Product Security Advisories
[Control Systems] Johnson Controls security advisory (AV26-837) - Canadian Centre for Cyber Security