Johnson Controls OpenBlue Employee Vulnerable to File Upload, XSS, and HTML Injection Flaws
CISA has issued an advisory for Johnson Controls OpenBlue Employee, detailing three vulnerabilities that could allow for unrestricted file uploads, stored cross-site scripting, and arbitrary HTML injection.
CISA has released an advisory detailing critical vulnerabilities affecting Johnson Controls' OpenBlue Employee software, specifically versions prior to V2025.3.1. The identified flaws, cataloged as CVE-2026-21662, CVE-2026-34495, and CVE-2026-34497, pose significant risks to the integrity and security of the application and its users.
CVE-2026-21662, an unrestricted file upload vulnerability, allows attackers to bypass security measures and upload malicious files. These files, potentially containing dangerous content, could be stored in predictable locations within the application's file system. This could then be leveraged by an attacker to further compromise the application or gain unauthorized access to user data or system functionalities.
Adding to the severity, CVE-2026-34495 is a stored cross-site scripting (XSS) vulnerability. This flaw arises when the application fails to properly sanitize user-supplied input that is subsequently stored in the application's database. When other users access the compromised content, the malicious JavaScript code is executed within their browser, potentially leading to session hijacking, credential theft, or redirection to malicious websites. The persistent nature of stored XSS makes it particularly dangerous as the payload remains active until manually removed.
Furthermore, CVE-2026-34497 introduces an arbitrary HTML injection vulnerability. This occurs when user-controlled input is embedded into web pages without adequate encoding or sanitization. Attackers can exploit this to inject malicious HTML markup, altering the visual presentation of web content or manipulating the Document Object Model (DOM). While not directly executing scripts like XSS, HTML injection can serve as a precursor to more severe attacks by modifying the user interface or redirecting users.
The affected product is Johnson Controls OpenBlue Employee (also known as FMS Employee) with versions less than or equal to V2025.3.1. These vulnerabilities have been identified across critical infrastructure sectors including Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, and Energy, with deployments worldwide. The potential impact ranges from low to medium severity, with CVSS v3.1 scores indicating low impact for some vectors, but the combination of these flaws presents a considerable risk.
Johnson Controls has provided a set of recommended mitigations and remediations. The primary recommendation is to apply the latest product update for OpenBlue Employee. For customers running V2025.3.1 or earlier, applying the latest available update is crucial. Additional defensive measures include limiting application access to authorized users, enforcing strong authentication, and enabling specific settings like "Do Not Show Files" if not actively used.
Further mitigation strategies involve employing a Web Application Firewall (WAF) to detect and block malicious requests, regularly investigating and removing suspicious content within the application, and limiting internet exposure by restricting access to trusted networks or VPN users. Customers are also advised to review uploaded content periodically and remove unnecessary files. For more detailed guidance, Johnson Controls directs users to their Product Security Advisory JCI-PSA-2026-09.
These vulnerabilities underscore the ongoing challenges in securing complex software systems, particularly those deployed in critical infrastructure. The combination of file upload, XSS, and HTML injection flaws highlights the need for robust input validation and output encoding mechanisms to prevent attackers from exploiting user-supplied data.