EUVD-2026-51590
GHSA-9hxq-5m48-2w2f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector, high privileges required to inject; user interaction required for victim; scope changes to victim browser; low C and I for session/content impact.
Primary rating from Vendor (jci).
CVSS VectorVendor: jci
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS).
This issue affects FM Systems Employee: before 2025.3.1.
AnalysisAI
Stored or reflected cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated attacker to inject script-related HTML tags into web pages that are subsequently rendered in other users' browsers. The attack requires passive user interaction from a victim and yields low-confidentiality impact, consistent with session token or cookie theft scoped to the vulnerable application. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS 4.0 score of 4.8 reflects the constrained, privilege-gated nature of the vulnerability.
Technical ContextAI
CWE-80 (Improper Neutralization of Script-Related HTML Tags) describes a failure to sanitize or encode user-supplied input before it is written into HTML output, enabling injection of tags such as <script>, <img onerror=...>, or similar constructs. The affected product is identified by CPE cpe:2.3:a:johnson_controls:fm_systems_employee:*:*:*:*:*:*:*:*, meaning all versions of Johnson Controls FM Systems Employee prior to 2025.3.1 are in scope. FM Systems Employee is a workplace and facility management web application. The XSS surface is within the web interface where high-privileged users can submit content that is later rendered to other users without adequate output encoding.
RemediationAI
Upgrade FM Systems Employee to version 2025.3.1 or later, which resolves this XSS vulnerability per the vendor advisory at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories. If immediate patching is not feasible, restrict access to the FM Systems Employee web interface to trusted internal networks and enforce least-privilege account management to limit the population of users who can inject content - since exploitation requires PR:H, reducing the number of high-privileged accounts directly limits attack surface. Implementing a Content Security Policy (CSP) header on the application server as a compensating control would reduce the impact of any injected scripts by blocking inline script execution, though this may affect legitimate application functionality and should be tested before deployment.
More in Fm Systems Employee
View allStored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged aut
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today