The vulnerability identified as CVE-2026-21662 in Johnson Controls FM Systems Employee involves unrestricted upload of files with dangerous types, classified under CWE-434. This flaw allows potentially malicious files to be uploaded without proper validation or restriction. The affected product versions are those prior to 2025.3.1. The CVSS 4.0 base score is 4.8 (medium severity), indicating a network attack vector with low complexity but requiring high privileges and partial user interaction. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker with high privileges and partial user interaction could upload malicious files to the affected system, potentially leading to limited confidentiality and integrity impacts. The vulnerability does not require user privileges beyond high-level access and does not impact availability or system confidentiality significantly according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions to trusted users only and implement additional file validation controls if possible.