Is CVE-2026-34497 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34497 being exploited in the wild.

How severe is CVE-2026-34497?

Informational severity, with a CVSS score of 4.8, published 31 July 2026.

Which products and versions are affected?

Johnson Controls FM Systems Employee before 2025.3.1.

Is there a fix for CVE-2026-34497?

A patch was published on 2025.3.1: Vulnerability fixed in this version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34497 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34497?

Check whether you run Johnson Controls FM Systems Employee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34497: Johnson Controls FM Systems Employee Cross-Site Scripting

CVE-2026-34497 · Severity: info · CVSS 4.8 · Published 2026-07-31

Johnson Controls FM Systems Employee, a workplace management tool, is affected by a security vulnerability that could allow an attacker to inject malicious scripts into the application's web interface. If exploited, this could allow an attacker to perform actions on behalf of other users or access sensitive information within the platform. The risk is mitigated by the fact that an attacker would need high-level administrative privileges and a legitimate user would need to interact with a malicious link or page.

Technologies: Johnson Controls FM Systems Employee. Vendors: Johnson Controls.

Quick answers

Is CVE-2026-34497 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34497 being exploited in the wild.
How severe is CVE-2026-34497?: Informational severity, with a CVSS score of 4.8, published 31 July 2026.
Which products and versions are affected?: Johnson Controls FM Systems Employee before 2025.3.1.
Is there a fix for CVE-2026-34497?: A patch was published on 2025.3.1: Vulnerability fixed in this version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34497 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34497?: Check whether you run Johnson Controls FM Systems Employee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A basic Cross-Site Scripting (XSS) vulnerability exists in Johnson Controls FM Systems Employee due to CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). The flaw allows a remote attacker with high privileges (PR:H) to inject malicious scripts into web pages viewed by other users. Exploitation requires user interaction (UI:P) from the victim. Successful exploitation could lead to a limited loss of confidentiality (VC:L). The issue is resolved in version 2025.3.1.

Affected products

Johnson Controls FM Systems Employee before 2025.3.1

Timeline

2026-07-31: disclosed: Initial advisory publication
2025.3.1: patched: Vulnerability fixed in this version

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.