Is CVE-2026-34495 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34495 being exploited in the wild.

How severe is CVE-2026-34495?

Informational severity, with a CVSS score of 4.8, published 31 July 2026.

Which products and versions are affected?

Johnson Controls FM Systems Employee before 2025.3.1.

Is there a fix for CVE-2026-34495?

A patch was published on 2025.3.1: Vulnerability fixed in this version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34495 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34495?

Check whether you run Johnson Controls FM Systems Employee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34495: Johnson Controls FM Systems Employee Stored XSS

CVE-2026-34495 · Severity: info · CVSS 4.8 · Published 2026-07-31

Johnson Controls FM:Systems Employee, a workplace management tool, is affected by a security vulnerability that could allow an attacker to inject malicious scripts into the application. If exploited, these scripts could execute in the browser of other users, potentially leading to unauthorized actions or data access within the platform. This issue is resolved in version 2025.3.1.

Technologies: Johnson Controls FM Systems Employee. Vendors: Johnson Controls.

Quick answers

Is CVE-2026-34495 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34495 being exploited in the wild.
How severe is CVE-2026-34495?: Informational severity, with a CVSS score of 4.8, published 31 July 2026.
Which products and versions are affected?: Johnson Controls FM Systems Employee before 2025.3.1.
Is there a fix for CVE-2026-34495?: A patch was published on 2025.3.1: Vulnerability fixed in this version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34495 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34495?: Check whether you run Johnson Controls FM Systems Employee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in Johnson Controls FM Systems Employee versions prior to 2025.3.1. The flaw stems from improper neutralization of user-supplied input during web page generation (CWE-79). An attacker with high privileges can inject malicious scripts that are stored on the server and subsequently executed in the context of another user's browser session when they view the affected page. The attack requires network connectivity and some user interaction. The vulnerability is addressed in version 2025.3.1.

Affected products

Johnson Controls FM Systems Employee before 2025.3.1

Timeline

2026-07-31: advisory: Initial publication of CVE-2026-34495 by Johnson Controls
2025.3.1: patched: Vulnerability fixed in this version

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.