CVE-2026-21662: Johnsoncontrols Fms Employee

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.

Affected products

• Johnsoncontrols Fms Employee: up to and including 2025.3.1

Published 2026-07-31. Last modified 2026-08-10.