CVE-2026-21662: FM Systems Employee File Upload Vulnerability

CVE-2026-21662 Overview

CVE-2026-21662 is an unrestricted file upload vulnerability in Johnson Controls FM Systems Employee. The flaw allows an authenticated user with high privileges to upload files of dangerous types, enabling the introduction of malicious content into the application. The issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). Johnson Controls has addressed the vulnerability in FM Systems Employee version 2025.3.1. All prior versions remain affected.

Critical Impact
An authenticated attacker with high privileges can upload malicious files that may be used to execute code, distribute malware, or compromise application integrity when user interaction occurs.

Affected Products

Johnson Controls FM Systems Employee versions prior to 2025.3.1
FM Systems Employee deployments exposing file upload functionality to authenticated users
Environments where uploaded files are served to or opened by other users

Discovery Timeline

2026-07-31 - CVE-2026-21662 published to the National Vulnerability Database (NVD)
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-21662

Vulnerability Analysis

The vulnerability resides in the file upload handling logic of FM Systems Employee. The application accepts uploaded files without adequately validating file type, extension, or content. An attacker with existing high-privilege access can upload files that the platform should otherwise reject, such as executable scripts or content designed to be interpreted by clients or the server.

The attack requires user interaction, meaning the malicious payload typically executes when another user interacts with the uploaded artifact. Successful exploitation impacts confidentiality and integrity of the target system, but does not directly affect availability based on the published vector.

The EPSS probability for this CVE is 0.409%, reflecting limited observed exploitation activity at the time of publication.

Root Cause

The root cause is missing or insufficient validation on the file upload endpoint. The application does not enforce a strict allowlist of file extensions, MIME types, or content signatures. This gap in input validation permits dangerous file types to be stored and later delivered to users or processed by server-side components.

Attack Vector

Exploitation follows a network-based path. The attacker authenticates with existing high-privilege credentials, then submits a crafted file to the upload endpoint. The file bypasses type restrictions because validation is either absent or improperly implemented. Once stored, the malicious file can be accessed by other users or triggered through downstream functionality that processes the artifact.

No verified public proof-of-concept code is available. See the Johnson Controls Security Advisory for vendor-published technical details.

Detection Methods for CVE-2026-21662

Indicators of Compromise

Uploaded files with executable extensions such as .exe, .js, .hta, .svg, .html, or double extensions like .pdf.exe in FM Systems Employee storage
Anomalous upload activity from privileged accounts outside normal working hours
Web server access logs showing requests to uploaded files followed by client-side execution or unexpected process spawns

Detection Strategies

Inspect FM Systems Employee upload directories for file types outside the expected allowlist of business documents and images
Correlate authentication events for high-privilege accounts with upload activity to identify unusual patterns
Deploy web application firewall (WAF) rules that inspect uploaded content for script signatures and executable headers

Monitoring Recommendations

Enable audit logging on all file upload endpoints and forward logs to a centralized SIEM for retention and correlation
Monitor file integrity on the FM Systems Employee storage volume for new files with suspicious extensions or MIME types
Alert on any post-upload access patterns where uploaded artifacts are retrieved by multiple distinct users in short intervals

How to Mitigate CVE-2026-21662

Immediate Actions Required

Upgrade Johnson Controls FM Systems Employee to version 2025.3.1 or later
Audit all existing uploaded content in the application storage for files that violate the expected allowlist
Review and reduce the number of accounts assigned high privileges in FM Systems Employee

Patch Information

Johnson Controls has released FM Systems Employee 2025.3.1, which remediates the unrestricted file upload flaw. Administrators should consult the Johnson Controls Security Advisory for the current advisory bulletin and upgrade instructions.

Workarounds

Restrict access to the file upload feature to a minimal set of trusted administrators until patching is complete
Place a reverse proxy or WAF in front of the application to block uploads with dangerous extensions and inspect MIME types
Configure the storage location to prevent direct execution by serving uploaded files with Content-Disposition: attachment and a restrictive Content-Security-Policy

bash

# Example nginx configuration to prevent execution of uploaded files
location /uploads/ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "default-src 'none'";
    types { }
    default_type application/octet-stream;
}