CVE-2026-21662 is an unrestricted file upload flaw in Johnson Controls FM Systems Employee, scored 9.8 (Critical). The application accepts files of dangerous types, which can allow malicious files to be used. Versions before 2025.3.1 are affected, so upgrade to 2025.3.1 or later and check the Johnson Controls advisory.
What's affected
- Product: Johnson Controls FM Systems Employee
- Affected: versions before 2025.3.1
- Fixed: 2025.3.1 is the first unaffected version implied by the record. Confirm the fixed build in the Johnson Controls advisory
- Status: The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
The vendor advisories page we fetched lists advisories by region and did not display the text for this one, so the details come from the CVE record.
How to check if you're exposed
Read the product version from the FM Systems Employee admin or about page, and compare it with 2025.3.1.
Then look at the web server and the application upload folders for files that do not belong, such as scripts or executables where documents and images should be. Check who can reach the application from outside your network, since this flaw is rated as needing no login.
What to do now
- Upgrade FM Systems Employee to 2025.3.1 or later.
- Read the Johnson Controls advisory for any further steps the vendor lists.
- Limit access to the application to the users and networks that need it.
- Review upload folders for unexpected files and remove them after saving copies.
- Check the web server so it never runs files from upload locations.
Why it matters
The record files this under CWE-434, unrestricted upload of a file with a dangerous type. The application allows files to be uploaded without limiting the type, and the record says this allows using malicious files. The rating of 9.8 reflects a network attack with no login and no user action.
Upload features are risky because the server stores data from outside and may later open or run it. Safe designs check content, rename the file, store it outside the web root and require a signed in user.
Treat this as a priority upgrade: the fix version is named, and the exposure is wide.
Quick check
Which version fixes it?
The record says versions before 2025.3.1 are affected. Use 2025.3.1 or later, and confirm in the Johnson Controls advisory.
Does it need a login?
The CVSS vector lists no privileges required and no user interaction.
Sources
Last reviewed: 19 October 2026.
