This vulnerability (CVE-2026-34497) affects Johnson Controls FM Systems Employee versions before 2025.3.1. It is classified as CWE-80, indicating improper neutralization of script-related HTML tags in web pages, which leads to Cross-Site Scripting (XSS). The CVSS 4.0 base score is 4.8 (medium), with network attack vector, low complexity, high privileges required, partial user interaction, and low impact on confidentiality. The vulnerability allows injection of script code due to insufficient sanitization of HTML input. There is no vendor advisory or patch information available at this time.

An attacker with high privileges and partial user interaction could exploit this vulnerability to execute script code in the context of the affected web application. This could lead to limited confidentiality impact such as theft of session information or manipulation of web content. The overall impact is rated medium severity based on the CVSS score and vector details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting high privilege user access and minimizing exposure to untrusted input in the affected application. Monitor vendor communications for updates on patches or official mitigations.