CVE-2025-26381

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.

Metrics

CVSS 4.0 6.5/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-425

Affected software

VendorProductVersions
Johnson ControlsOpenBlue Workplace (formerly FM Systems)<= 2025.1.2

References

Timeline

Published
Dec 17, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-263829.3Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issueCVE-2025-263836.3The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the WindowsCVE-2025-263859.5Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) VulnCVE-2025-263867.1Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration UtiCVE-2025-263899.8A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does CVE-2025-26395.3A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic. This vulnerability affects unknown code of the file /uCVE-2025-263909.8A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vuCVE-2025-263915.4SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-creCVE-2025-263924.6SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level accountCVE-2025-263935.4SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to escalate privileges, lCVE-2025-263944.8SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attackCVE-2025-263954.3SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL.
CVE-2025-26381: Medium severity, CVSS 6.5 | Vulnix