PT-2026-66830

CVE-2026-34497

·

Published

2026-07-31

·

Updated

2026-08-10

Description by

CVSS 3.1
5.4
Medium
MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Johnson Controls FM Systems Employee versions prior to 2025.3.1
Description Improper neutralization of script-related HTML tags in a web page allows for Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.
Recommendations Update Johnson Controls FM Systems Employee to version 2025.3.1 or later.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Related identifiers
CVE-2026-34497
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com