FM Systems Employee CVE-2026-34497

Exploitation requires two distinct conditions: first, the attacker must be authenticated with high-privilege access (PR:H per CVSS 4.0 vector) to the FM Systems Employee web application, meaning a compromised or malicious high-privileged account is a hard prerequisite. Second, a separate victim user must passively view the page containing the injected script (UI:P). Exploitation is limited to the web application context - it does not extend to subsequent systems (SC:N/SI:N/SA:N). The vulnerability affects only versions of FM Systems Employee before 2025.3.1. There is no indication from the available data that exploitation is possible in a default unauthenticated posture or without the high-privilege prerequisite.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N encodes the key risk limiters: exploitation requires an attacker who already holds high privileges (PR:H), and a victim who passively views the injected content (UI:P). Confidentiality impact is low (VC:L), with no integrity or availability impact claimed. This profile is consistent with a stored XSS where an admin-level user embeds a script that harvests another user's session credentials. Real-world risk is constrained: an attacker must first obtain high-privilege access to the FM Systems Employee application before the XSS becomes exploitable, significantly narrowing the threat population. There is no CISA KEV listing and no public exploit code identified, and EPSS data is not provided. The combination of high prerequisite privilege, low impact ceiling, and absence of known exploitation makes this a medium-to-low operational priority for most organizations, though patching remains appropriate. No conflicting signals between the description and the CVSS vector were identified.

An attacker who has obtained high-privileged credentials to FM Systems Employee - whether through phishing, credential reuse, or insider access - navigates to a content input area and submits a payload containing a script tag designed to exfiltrate session cookies to an attacker-controlled endpoint. A second user with a valid session subsequently loads the page containing the injected content, causing their browser to execute the script and transmit their session token to the attacker. No public exploit code has been identified, so exploitation requires manual crafting of the payload.