The vulnerability identified as CVE-2026-34497 is a basic Cross-Site Scripting (XSS) issue in Johnson Controls FM Systems Employee. It arises from improper neutralization of script-related HTML tags in web pages, allowing injection of malicious scripts. The affected versions are those prior to 2025.3.1. The CVSS 4.0 vector indicates network attack vector, low confidentiality impact, no integrity or availability impact, and requires high privileges and partial user interaction. There is no indication of known exploits or cloud service involvement.

Successful exploitation could allow an attacker with high privileges to execute script code in the context of the affected application, potentially leading to limited confidentiality exposure. There is no reported impact on integrity or availability. The vulnerability does not appear to be actively exploited in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor vendor communications for updates. Until a fix is available, limit exposure by restricting high-privilege user access and exercising caution with user input that may be rendered in the application.