CVE Catalog
CVE-2026-21662
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.41%
34th percentile - higher than 34% of all known CVEs
Summary
In Johnson Controls FM Systems Employee before version 2025.3.1, there is an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files.
Risk Assessment
An attacker can upload a malicious file (e.g., a script) that may be executed on the server, leading to system compromise or data theft.
Recommendation
Update FM Systems Employee to version 2025.3.1 or later.
Original NVD description (English source)
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.