CVE-2026-21662

Analyzed Analyzed - Analysis Complete

Unrestricted File Upload in Johnson Controls FM Systems Employee

Publication date: 2026-07-31

Last updated on: 2026-08-10

Assigner: Johnson Controls

Description

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-08-10

Generated

2026-08-21

AI Q&A

2026-07-31

EPSS Evaluated

2026-08-19

NVD

CVE-2026-21662

EUVD

EUVD-2026-51588

Affected Vendors & Products

Vendor	Product	Version / Range
johnsoncontrols	fms_employee	to 2025.3.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability allows attackers to upload malicious files to Johnson Controls FM Systems Employee software versions before 2025.3.1. The flaw stems from improper file type restrictions, enabling execution of dangerous content.

Detection Guidance

This vulnerability involves unrestricted upload of dangerous file types in Johnson Controls FM Systems Employee. To detect it, inspect file upload functionality for allowed file extensions and MIME types. Check server logs for unexpected file uploads, especially executable or script files. Review system for files with dangerous extensions like .exe, .bat, .sh, or .js in upload directories. Monitor for unauthorized file execution or access.

Impact Analysis

Attackers could exploit this to upload malware, gain unauthorized access, or disrupt operations. Systems running affected versions may face data breaches, system compromise, or service disruptions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to potential data breaches or unauthorized access. Organizations may face legal penalties, fines, or reputational damage.

Mitigation Strategies

Update FM Systems Employee to version 2025.3.1 or later to address the unrestricted file upload vulnerability.

Hi! I’m here to help you understand CVE-2026-21662. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70