IM
IronMonkey Threat Research
‹ Back to ICS Advisories

Johnson Controls OpenBlue Employee

LOW
CVSS 2.4
Date 2026-07-30T06:00:00+00:00
Source cisa-csaf
Published by CISA

// Description

Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files, execute stored cross-site scripting attacks, or inject arbitrary HTML content.

// Vulnerabilities (3)

CVE ID CVSS Score Severity Description
CVE-2026-21662 2.4 low
The application does not adequately restrict the types of files that can be uploaded, allowing an attacker to submit files with dangerous content types. Uploaded files may be stored in predictable locations and could be leveraged for further exploitation against the application or its users.
CVE-2026-34495 2.4 low
Stored XSS occurs when the application improperly handles user input and stores malicious JavaScript code within its database. This script is then rendered and executed whenever another user accesses the compromised page. Unlike reflected XSS, persistent XSS is particularly dangerous because the payload remains active until it is manually removed from the system.
CVE-2026-34497 2.4 low
HTML injection occurs when user-controlled input is embedded into web pages without proper encoding or sanitization, allowing attackers to inject arbitrary HTML markup. This vulnerability enables attackers to manipulate the Document Object Model (DOM) structure and alter the visual presentation of web content. Unlike Cross-Site Scripting (XSS), HTML injection typically involves static HTML content rather than executable JavaScript, though it can serve as a stepping stone to more severe attacks.

// Remediations (8)

Mitigation: Enable the "Do Not Show Files" location setting if the feature is not being actively used.
Enable the "Do Not Show Files" location setting if the feature is not being actively used.
Mitigation: Limit internet exposure by restricting access to trusted networks or VPN users where practical.
Limit internet exposure by restricting access to trusted networks or VPN users where practical.
Mitigation: Johnson Controls recommends the following defensive measures to help reduce the risk of exploitation
Johnson Controls recommends the following defensive measures to help reduce the risk of exploitation: Apply the latest product update for OpenBlue Employee (FMS Employee). Customers running V2025.3.1 [LV1.1] or earlier should apply the latest available update.
Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-09 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
Mitigation: Employ a Web Application Firewall (WAF) to help detect and block malicious requests.
Employ a Web Application Firewall (WAF) to help detect and block malicious requests.
Mitigation: Investigate and promptly remove any suspicious files or content discovered within the application.
Investigate and promptly remove any suspicious files or content discovered within the application.
Mitigation: Limit application access to authorized users and enforce strong authentication.
Limit application access to authorized users and enforce strong authentication.
Mitigation: Review uploaded content periodically and remove content that is no longer required.
Review uploaded content periodically and remove content that is no longer required.

// References