Johnson Controls OpenBlue Employee

Summary

Multiple vulnerabilities have been disclosed in Johnson Controls' OpenBlue Employee (FMS Employee) software, affecting versions prior to V2025.3.1. These flaws include unrestricted file uploads, stored cross-site scripting (XSS), and arbitrary HTML injection. Successful exploitation could allow attackers to upload malicious files or execute scripts, potentially leading to further compromise.

Full text

ICS Advisory Johnson Controls OpenBlue Employee Release DateJuly 30, 2026 Alert CodeICSA-26-211-02 Related topics: Industrial Control System Vulnerabilities , Industrial Control Systems View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files, execute stored cross-site scripting attacks, or inject arbitrary HTML content. The following versions of Johnson Controls OpenBlue Employee are affected: OpenBlue Employee (FMS Employee) <=V2025.3.1 (CVE-2026-21662, CVE-2026-34495, CVE-2026-34497) CVSS Vendor Equipment Vulnerabilities v3 2.4 Johnson Controls Inc. Johnson Controls OpenBlue Employee Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Background Critical Infrastructure Sectors: Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland Vulnerabilities Expand All + CVE-2026-21662 The application does not adequately restrict the types of files that can be uploaded, allowing an attacker to submit files with dangerous content types. Uploaded files may be stored in predictable locations and could be leveraged for further exploitation against the application or its users. View CVE Details Affected Products Johnson Controls OpenBlue Employee Vendor:Johnson Controls Inc. Product Version:Johnson Controls Inc. OpenBlue Employee (FMS Employee): <=V2025.3.1 Product Status:known_affected Remediations MitigationJohnson Controls recommends the following defensive measures to help reduce the risk of exploitation: Apply the latest product update for OpenBlue Employee (FMS Employee). Customers running V2025.3.1 [LV1.1] or earlier should apply the latest available update. MitigationLimit application access to authorized users and enforce strong authentication. MitigationEnable the "Do Not Show Files" location setting if the feature is not being actively used. MitigationEmploy a Web Application Firewall (WAF) to help detect and block malicious requests. MitigationInvestigate and promptly remove any suspicious files or content discovered within the application. MitigationLimit internet exposure by restricting access to trusted networks or VPN users where practical. MitigationReview uploaded content periodically and remove content that is no longer required. MitigationFor more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-09 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisorieshttps://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories Relevant CWE: CWE-434 Unrestricted Upload of File with Dangerous Type Metrics CVSS Version Base Score Base Severity Vector String 3.1 2.4 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N 4.0 4.8 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2026-34495 Stored XSS occurs when the application improperly handles user input and stores malicious JavaScript code within its database. This script is then rendered and executed whenever another user accesses the compromised page. Unlike reflected XSS, persistent XSS is particularly dangerous because the payload remains active until it is manually removed from the system. View CVE Details Affected Products Johnson Controls OpenBlue Employee Vendor:Johnson Controls Inc. Product Version:Johnson Controls Inc. OpenBlue Employee (FMS Employee): <=V2025.3.1 Product Status:known_affected Remediations MitigationJohnson Controls recommends the following defensive measures to help reduce the risk of exploitation: Apply the latest product update for OpenBlue Employee (FMS Employee). Customers running V2025.3.1 [LV1.1] or earlier should apply the latest available update. MitigationLimit application access to authorized users and enforce strong authentication. MitigationEnable the "Do Not Show Files" location setting if the feature is not being actively used. MitigationEmploy a Web Application Firewall (WAF) to help detect and block malicious requests. MitigationInvestigate and promptly remove any suspicious files or content discovered within the application. MitigationLimit internet exposure by restricting access to trusted networks or VPN users where practical. MitigationReview uploaded content periodically and remove content that is no longer required. MitigationFor more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-09 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisorieshttps://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Metrics CVSS Version Base Score Base Severity Vector String 3.1 2.4 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N 4.0 4.8 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2026-34497 HTML injection occurs when user-controlled input is embedded into web pages without proper encoding or sanitization, allowing attackers to inject arbitrary HTML markup. This vulnerability enables attackers to manipulate the Document Object Model (DOM) structure and alter the visual presentation of web content. Unlike Cross-Site Scripting (XSS), HTML injection typically involves static HTML content rather than executable JavaScript, though it can serve as a stepping stone to more severe attacks. View CVE Details Affected Products Johnson Controls OpenBlue Employee Vendor:Johnson Controls Inc. Product Version:Johnson Controls Inc. OpenBlue Employee (FMS Employee): <=V2025.3.1 Product Status:known_affected Remediations MitigationJohnson Controls recommends the following defensive measures to help reduce the risk of exploitation: Apply the latest product update for OpenBlue Employee (FMS Employee). Customers running V2025.3.1 [LV1.1] or earlier should apply the latest available update. MitigationLimit application access to authorized users and enforce strong authentication. MitigationEnable the "Do Not Show Files" location setting if the feature is not being actively used. MitigationEmploy a Web Application Firewall (WAF) to help detect and block malicious requests. MitigationInvestigate and promptly remove any suspicious files or content discovered within the application. MitigationLimit internet exposure by restricting access to trusted networks or VPN users where practical. MitigationReview uploaded content periodically and remove content that is no longer required. MitigationFor more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-09 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisorieshttps://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories Relevant CWE: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Metrics CVSS Version Base Score Base Severity Vector String 3.1 2.4 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N 4.0 4.8 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Acknowledgments Johnson Controls reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from

Indicators of Compromise

• cve — CVE-2026-21662
• cve — CVE-2026-34495
• cve — CVE-2026-34497

Entities