Is there a patch available for CVE-2026-21662?

Yes, a patch is available for CVE-2026-21662. Update the affected software to the latest version immediately.

FM Systems Employee CVE-2026-21662

Q: What is the CVSS score of CVE-2026-21662?

CVE-2026-21662 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-51588 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-31 jci

GHSA-9m8h-rcg4-v896

File Upload Fm Systems Employee Johnson Controls

4.8

CVSS 4.0 · Vendor: jci

Severity by source

Vendor (jci) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

High privileges required per CVSS 4.0 PR:H; user interaction maps to UI:R; no scope change or availability impact confirmed.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jci).

CVSS VectorVendor: jci

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 31, 2026 - 19:02 EUVD

Analysis Generated

Jul 31, 2026 - 18:50 vuln.today

DescriptionCVE.org

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.

This issue affects FM Systems Employee: before 2025.3.1.

AnalysisAI

Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

FM Systems Employee is Johnson Controls' enterprise facility and workspace management platform (CPE: cpe:2.3:a:johnson_controls:fm_systems_employee). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), where the application fails to adequately validate or restrict the file types accepted during an upload operation. Depending on server configuration, uploaded dangerous files - such as HTML/JS (enabling stored XSS), PHP/ASPX (enabling server-side code execution), or SVG files with embedded scripts - may be stored and later served to other users or executed by the web server. The CVSS 4.0 vector specifies AV:N (web-accessible upload endpoint), AC:L (no special conditions to trigger the flaw), and AT:N (no additional attack requirements), meaning the upload mechanism itself is straightforward to abuse once access is obtained.

RemediationAI

Upgrade FM Systems Employee to version 2025.3.1 or later, which resolves this vulnerability per the vendor advisory at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories. If immediate patching is not feasible, restrict upload functionality to the minimum required set of trusted file types at the application or web server layer (allowlist approach), and ensure uploaded files are stored outside the web root or in a directory configured to not execute server-side scripts. Audit existing privileged accounts and enforce least-privilege principles to reduce the population of accounts capable of reaching the upload feature. Monitor upload activity for anomalous file extensions as a detective control.