CISA Warns of Three OpenBlue Employee Flaws
Unrestricted file upload and stored XSS sound alarming, but all three require high privileges, muting CVSS severity even as critical infrastructure sectors worldwide are affected.
TL;DR
CISA published ICS advisory ICSA-26-211-02 covering three vulnerabilities in Johnson Controls OpenBlue Employee through version V2025.3.1: unrestricted file upload (CVE-2026-21662), stored XSS (CVE-2026-34495), and HTML injection (CVE-2026-34497). Affected sectors include critical manufacturing, energy, transportation, commercial facilities, and government services, with deployments worldwide. Johnson Controls recommends applying the latest product update immediately and limiting internet exposure as interim mitigation.
The three vulnerabilities affect OpenBlue Employee (FMS Employee) through V2025.3.1. CVE-2026-21662 allows an attacker with high privileges to upload files with dangerous content types to predictable storage locations, creating a foothold for further exploitation. CVE-2026-34495 is a stored XSS flaw: malicious JavaScript persists in the application database and executes in the browsers of other users who access compromised pages. CVE-2026-34497 enables HTML injection through unsanitized user input, which can manipulate the DOM and alter page presentation, a stepping stone to more severe attacks.
All three carry a CVSS v3.1 base score of 2.4 (LOW) and a CVSS v4.0 base score of 4.8 (MEDIUM). The low scores reflect the high privileges required for exploitation (PR:H) rather than the inherent danger of the flaw types. For OT and ICS environments running OpenBlue Employee, that's a distinction that matters: a compromised high-privilege account turns these from theoretical to operational threats.
Johnson Controls recommends applying the latest product update immediately. For organizations that can't patch, mitigations include restricting access to authorized users with strong authentication, enabling the "Do Not Show Files" location setting if unused, deploying a WAF, limiting internet exposure to trusted networks or VPNs, and periodically reviewing and removing uploaded content. The full advisory is available in Johnson Controls Product Security Advisory JCI-PSA-2026-09.
Published ·Deep Fathom