CVE-2026-21662
Received Received - Intake

Unrestricted File Upload in Johnson Controls FM Systems Employee

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Johnson Controls

Description
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-21662
EUVD
EUVD-2026-51588

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
johnson_controls fm_systems_employee to 2025.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows attackers to upload malicious files to Johnson Controls FM Systems Employee software versions before 2025.3.1. The flaw stems from improper file type restrictions, enabling execution of dangerous content.

Impact Analysis

Attackers could exploit this to upload malware, gain unauthorized access, or disrupt operations. Systems running affected versions may face data breaches, system compromise, or service disruptions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to potential data breaches or unauthorized access. Organizations may face legal penalties, fines, or reputational damage.

Mitigation Strategies

Update FM Systems Employee to version 2025.3.1 or later to address the unrestricted file upload vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-21662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart