Cross-Site Scripting Vulnerability in Johnson Controls FM Systems Employee
CVE-2026-34497

4.8MEDIUM

Key Information:

Vendor: Johnson Controls
Status: Fm Systems Employee
Vendor: CVE Published:; 31 July 2026

🔔 Create Johnson Controls Vulnerability Alert

What is CVE-2026-34497?

A Cross-Site Scripting (XSS) vulnerability exists in Johnson Controls FM Systems Employee, allowing attackers to inject harmful scripts into web pages. This issue affects versions of FM Systems Employee released prior to 2025.3.1, potentially leading to unauthorized actions on behalf of users and exposing sensitive information. Organizations using affected versions should prioritize applying updates to mitigate risks.

Affected Version(s)

FM Systems Employee 0 < 2025.3.1

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...

CVSS V4

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 31, 2026
Vulnerability Reserved
Mar 30, 2026

CVE-2026-34497 Data

JSON