CVE-2026-21662
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In Johnson Controls FM Systems Employee before version 2025.3.1, there is an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files.
Risk Assessment
An attacker can upload a malicious file (e.g., a script) that may be executed on the server, leading to system compromise or data theft.
Recommendation
Update FM Systems Employee to version 2025.3.1 or later.
Other vulnerabilities in Johnson Controls FM Systems Employee
See all- CVE-2026-34497Medium
In Johnson Controls FM Systems Employee before version 2025.3.1, there is a basic XSS vulnerability due to improper neutralization of script-related HTML tags in a web page.
- CVE-2026-34495Medium
In Johnson Controls FM Systems Employee before version 2025.3.1, there is a Stored XSS vulnerability due to improper neutralization of input during web page generation.
Original NVD description (English source)
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.