FM Systems Employee CVE-2026-21662

Exploitation requires an authenticated session with high-privilege access (PR:H) within FM Systems Employee - a standard low-privileged user account is insufficient. Additionally, UI:P indicates a second user must passively interact with the malicious uploaded content for the attack to reach its intended impact. The vulnerability is reachable over the network (AV:N) with low attack complexity once authentication is satisfied. Exploitation is limited by: (1) the requirement for high-privilege credentials, making this primarily an insider-threat or post-compromise escalation vector; (2) the need for victim user interaction for the full impact chain to complete; and (3) the restricted impact scope (no availability impact, no subsequent-system impact per CVSS 4.0 metrics). Versions 2025.3.1 and later are not affected.

The CVSS 4.0 base score of 4.8 (Medium) accurately reflects constrained real-world exploitability. PR:H confirms exploitation is gated behind high-privilege authentication - an attacker must already control a privileged account within the FM Systems Employee platform. UI:P indicates some level of passive user interaction is required, consistent with a stored XSS or social-engineering scenario rather than direct remote code execution. Impact metrics are limited: VC:L and VI:L with no availability or subsequent-system impact, suggesting file upload leads to limited data exposure or integrity compromise rather than full system compromise. No EPSS data was provided; given the absence of KEV listing and public exploit code, opportunistic mass exploitation is unlikely. This vulnerability is a meaningful internal-threat or compromised-credential scenario rather than an externally-driven, high-urgency priority. The primary risk is an insider or account-compromised attacker planting malicious content to pivot against other users.

An attacker with a compromised high-privilege FM Systems Employee account navigates to the application's file upload feature and submits a malicious file - for example, an HTML file containing a credential-harvesting script or a server-executable script - which the application stores without adequate type validation. A second user (victim) then passively encounters the uploaded file through normal application workflow, triggering the malicious payload in their browser context. No public proof-of-concept has been identified at time of analysis.