Unrestricted File Upload Vulnerability in Johnson Controls FM Systems Employee
CVE-2026-21662

4.8MEDIUM

Key Information:

Vendor: Johnson Controls
Status: Fm Systems Employee
Vendor: CVE Published:; 31 July 2026

🔔 Create Johnson Controls Vulnerability Alert

What is CVE-2026-21662?

The vulnerability in Johnson Controls' FM Systems Employee allows attackers to upload files of dangerous types, potentially leading to the execution of malicious code. This security flaw is present in all versions prior to 2025.3.1, enabling users to exploit inadequate validation and restriction mechanisms during file uploads. Proper safeguards against untrusted files are crucial to prevent unauthorized access and system compromise.

Affected Version(s)

FM Systems Employee 0 < 2025.3.1

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 31, 2026
Vulnerability Reserved
Jan 2, 2026

CVE-2026-21662 Data

JSON