FM Systems Employee EUVD-2026-51589

Exploitation requires the attacker to possess a high-privilege authenticated account within FM Systems Employee (PR:H per CVSS 4.0 vector) - this is the primary limiting factor and rules out unauthenticated or low-privileged external exploitation. A second prerequisite is that at least one other authenticated user must subsequently view the page or resource where the attacker stored the XSS payload (UI:P); the exploit does not fire autonomously. The specific input field(s) susceptible to injection are not identified in available data. No special non-default configuration is implied - the vulnerability exists in the default application functionality accessible to high-privilege users. Exploitation is most realistically constrained to: (1) compromised admin credentials, (2) malicious insider with elevated FM Systems Employee access, or (3) privilege escalation from a lower-privileged account (not described in this CVE).

The CVSS 4.0 base score of 4.8 appropriately reflects a moderate-risk finding moderated significantly by the PR:H (high privileges required) and UI:P (user interaction required) metrics. The realistic threat model is constrained to insider abuse or scenarios where a privileged account is already compromised - unauthenticated external exploitation is not possible given the PR:H barrier. No EPSS score is provided in the input data, so exploitation probability cannot be quantitatively stated; structurally, the high-privilege prerequisite places this well below the threshold of broadly opportunistic attacks. There is no CISA KEV listing and no POC has been reported, further supporting a low-urgency exploitation outlook. The limited impact metrics (VC:L, VI:N, VA:N in vendor vector) confirm blast radius is constrained to individual session exposure rather than systemic compromise. This is a real but low-immediate-priority finding - most relevant in environments with elevated insider threat concern or where FM application admin accounts are shared or weakly protected.

A high-privilege FM Systems Employee user - such as an application administrator - injects a JavaScript payload into a stored input field (such as an employee record, comment field, or form entry). When a second authenticated user browses the page containing the stored payload, the script executes silently in their browser, potentially exfiltrating their session token to an attacker-controlled endpoint. No public POC has been identified; this scenario is most plausible in insider threat contexts or following compromise of a privileged account.