SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-34495

MEDIUM · CVSS 5.4 EPSS 0.14%

Source: NVD + CISA KEV + EPSS · Published 2026-07-31 · Last synced 2026-08-30

CyberRota Analysis

AI-Generated

A stored cross-site scripting (XSS) vulnerability exists in Johnson Controls FM Systems Employee, impacting versions prior to 2025.3.1, due to improper input neutralization during web page generation. This flaw could allow attackers to inject malicious scripts, potentially compromising user data and session integrity. Organizations using affected versions should prioritize remediation to safeguard against potential exploitation.

CVE
CVE-2026-34495
Severity
MEDIUM
CVSS
5.4
EPSS
0.14%

Original NVD Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.

Related CVEs

Other vulnerabilities affecting the same vendor(s)

CVE-2026-34497 MEDIUM CVE-2026-34490 MEDIUM CVE-2026-21662 CRITICAL CVE-2026-21660 CRITICAL CVE-2026-21659 CRITICAL CVE-2026-21658 CRITICAL