EUVD-2026-51589
GHSA-25v9-w9h4-jpjx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects mandatory high-privilege account for injection; S:C because stored XSS executes in a different user's browser security context; UI:R for required victim page view; I:L added as XSS enables limited victim-context actions beyond read.
Primary rating from Vendor (jci).
CVSS VectorVendor: jci
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS.
This issue affects FM Systems Employee: before 2025.3.1.
AnalysisAI
Stored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged authenticated attacker to inject persistent malicious scripts into the application that execute in victims' browsers when they view the affected content. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation requires an administrative-level account for payload injection and passive user interaction from a second victim. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Technical ContextAI
FM Systems Employee is a web-based facility management application from Johnson Controls, identified by CPE cpe:2.3:a:johnson_controls:fm_systems_employee:*:*:*:*:*:*:*:*. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant, meaning attacker-supplied input is persisted server-side and later rendered without adequate sanitization or output encoding in victim browsers. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:P confirms the attack is delivered over the network with low complexity, requires no special attack prerequisites, demands high privileges to plant the payload, and requires a victim user to passively view the poisoned page to trigger execution. The confidentiality impact is rated low (VC:L), consistent with the session-data or credential exposure typical of browser-resident XSS execution.
RemediationAI
Upgrade FM Systems Employee to version 2025.3.1 or later, which is the vendor-confirmed fix version per the Johnson Controls advisory at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories. Where immediate patching is not feasible, enforce strict least-privilege access controls by auditing and reducing the set of accounts holding high-privilege roles within FM Systems Employee, as exploitation requires such an account to inject the payload - shrinking that population directly reduces attack surface. Implementing a Content Security Policy (CSP) response header that restricts inline script execution can reduce XSS impact but will not eliminate the underlying injection flaw and may require application-level testing to avoid breaking legitimate functionality. Additionally, review and monitor audit logs for unexpected or anomalous content submissions in high-privilege user sessions.
More in Fm Systems Employee
View allStored or reflected cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a hig
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged aut
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today