CVE-2026-34495 is a stored cross-site scripting (CWE-79) vulnerability in Johnson Controls FM Systems Employee versions prior to 2025.3.1. The issue arises from improper input neutralization during web page generation, enabling injection of malicious scripts. The vulnerability requires high privileges to exploit and user interaction, with low complexity and limited impact on confidentiality and integrity. No vendor advisory or patch information is currently available.

An attacker with high privileges can inject malicious scripts that persist in the application and execute in the context of other users who view the affected pages. This may lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions within the application. The vulnerability does not affect availability and does not escalate privileges or impact system integrity beyond the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege user access and apply input validation or output encoding as a temporary mitigation if possible.