Skip to content
OpenAdvisories
Low ICSA-26-211-02 3 CVEs

Johnson Controls OpenBlue Employee

Published Jul 30, 2026 · Updated Jul 30, 2026

Vendor: Johnson Controls Product: OpenBlue Employee (FMS Employee)

Summary

Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files, execute stored cross-site scripting attacks, or inject arbitrary HTML content.

Vulnerabilities 3

  • Medium 4.8
    CVE-2026-21662

    FMS Employee Allows Upload of Unrestricted Files

    Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.

    Johnson Controls FM Systems Employee
  • Medium 4.8
    CVE-2026-34495

    FMS Employee vulnerable to XSS

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.

    Johnson Controls FM Systems Employee
  • Medium 4.8
    CVE-2026-34497

    FMS Employee Vulnerable to HTML Injection

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.

    Johnson Controls FM Systems Employee

Revision history

  1. #1

    Initial Republication of Johnson Controls Inc. Security Advisory JCI-PSA-2026-09

References