Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace

Summary

Vulnerabilities 1

• Medium 6.5
  CVE-2025-26381

  OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)

  Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.

  Johnson Controls OpenBlue Workplace (formerly FM Systems)
  Dec 17, 2025

Revision history

1. 2025-12-04 #1

   Initial Publication

References

• ICSA Advisory ICSA-25-338-03 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-03
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
• Recommended Practices
  https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
• Recommended Practices
  https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
• Recommended Practices
  https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks