Unauthorized Access Vulnerability in JCI Products by Johnson Controls
CVE-2025-26381

6.5MEDIUM

Key Information:

Vendor
CVE Published:
17 December 2025

What is CVE-2025-26381?

This vulnerability permits attackers to potentially exploit security loopholes in JCI products, leading to unauthorized access to sensitive information. If successfully exploited, attackers can leverage this access to compromise system integrity and confidentiality. Organizations utilizing JCI products must be aware of this risk and take appropriate measures to protect their systems.

Affected Version(s)

OpenBlue Workplace (formerly FM Systems) 0 <= 2025.1.2

References

CVSS V4

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-26381 : Unauthorized Access Vulnerability in JCI Products by Johnson Controls