CVE-2026-21662

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.

This issue affects FM Systems Employee: before 2025.3.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jul 31, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-216636.1HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. AnCVE-2026-216646.1HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of RevCVE-2026-216657.7The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.31CVE-2026-216668.8A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-216678.8A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-216686.5A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.CVE-2026-216699.9A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-21678.8A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/CVE-2026-216706.5A vulnerability allowing a low-privileged user to extract saved SSH credentials.CVE-2026-216719.1A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availabilitCVE-2026-216728.8A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.CVE-2026-216737.8iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have overflows and und
CVE-2026-21662: Critical severity, CVSS 9.8 | Vulnix