CISA 2026-07-30

Johnson Controls OpenBlue Employee

Machine-generated analysis · WAYSCloud LLM

OpenBlue Employee (FMS Employee) versions up to V2025.3.1 permit unrestricted file uploads and stored cross-site scripting.

Context

The advisory concerns Johnson Controls OpenBlue Employee (FMS Employee) software, versions ≤ V2025.3.1. It notes that the application does not restrict uploaded file types and is vulnerable to stored XSS and HTML injection, which could allow malicious file upload and script execution. The product is deployed worldwide across several critical infrastructure sectors. The advisory recommends applying the latest product update and enabling specific configuration settings.

Operator considerations

Check: inventory OpenBlue Employee installations and verify version numbers.
Isolate: restrict application access to authorized users and enforce strong authentication.
Patch: apply the latest product update for OpenBlue Employee (FMS Employee) to versions newer than V2025.3.1.
Log: monitor file upload activity and web server logs for unexpected file types or script execution attempts.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files, execute stored cross-site scripting attacks, or inject arbitrary HTML content.

The following versions of Johnson Controls OpenBlue Employee are affected:

OpenBlue Employee (FMS Employee)

Read the full advisory on CISA →