Johnsoncontrols Fms Employee — known CVE vulnerabilities

Every CVE whose affected-product data names Johnsoncontrols Fms Employee, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2026-21662 — CVSS 9.8 (critical): Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This…
• CVE-2026-34495 — CVSS 5.4 (medium): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee…
• CVE-2026-34497 — CVSS 5.4 (medium): Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows…