# CVE-2026-34497: Johnson Controls FM Systems Employee Cross-Site Scripting

Source: https://junglewise.ai/threats/cve-2026-34497-johnson-controls-fm-systems-employee-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-34497 · Severity: info · CVSS 4.8 · Published 2026-07-31

Johnson Controls FM Systems Employee, a workplace management tool, is affected by a security vulnerability that could allow an attacker to inject malicious scripts into the application's web interface. If exploited, this could allow an attacker to perform actions on behalf of other users or access sensitive information within the platform. The risk is mitigated by the fact that an attacker would need high-level administrative privileges and a legitimate user would need to interact with a malicious link or page.

Technologies: [Johnson Controls FM Systems Employee](https://junglewise.ai/threats/technologies/fm-systems-employee). Vendors: [Johnson Controls](https://junglewise.ai/threats/vendors/johnson-controls).

## Quick answers

**Is CVE-2026-34497 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34497 being exploited in the wild.

**How severe is CVE-2026-34497?** Informational severity, with a CVSS score of 4.8, published 31 July 2026.

**Which products and versions are affected?** Johnson Controls FM Systems Employee before 2025.3.1.

**Is there a fix for CVE-2026-34497?** A patch was published on 2025.3.1: Vulnerability fixed in this version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34497 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34497?** Check whether you run Johnson Controls FM Systems Employee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A basic Cross-Site Scripting (XSS) vulnerability exists in Johnson Controls FM Systems Employee due to CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). The flaw allows a remote attacker with high privileges (PR:H) to inject malicious scripts into web pages viewed by other users. Exploitation requires user interaction (UI:P) from the victim. Successful exploitation could lead to a limited loss of confidentiality (VC:L). The issue is resolved in version 2025.3.1.

## Affected products

- Johnson Controls FM Systems Employee before 2025.3.1

## Timeline

- 2026-07-31: disclosed: Initial advisory publication
- 2025.3.1: patched: Vulnerability fixed in this version

## References

- [https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)

## Related threats

- [Johnson Controls FM Systems Employee Stored XSS](https://junglewise.ai/threats/cve-2026-34495-johnson-controls-fm-systems-employee-stored-xss)
- [Johnson Controls FM Systems Employee unrestricted file upload](https://junglewise.ai/threats/cve-2026-21662-johnson-controls-fm-systems-employee-unrestricted-file-upload)