Vulnerabilities

CVSS

5.4 Medium

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Risk score

43.2

Published

2026-07-31

Status

Analyzed

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.

Weaknesses

CWE-80

Coverage 1

vulnerability

Johnson Controls OpenBlue Employee

Johnson Controls has released a security advisory (JCI-PSA-2026-09) addressing critical vulnerabilities in its OpenBlue Employee system. These vulnerabilities – including stored XSS, HTML injection, and file upload flaws…

CISA Advisories · Jul 30, 2026 High

CVE-2026-21662CVE-2026-34495CVE-2026-34497vulnerabilityxsshtml injection

All articles mentioning it

Advisories and references

• johnsoncontrols.com/trust-center/cybersecurity/security-advisories