Vulnerability · Published Dec 17, 2025 · Assigned by jci
CVE-2025-26381OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)
Medium 6.5
In plain English
A medium-severity security flaw in OpenBlue Workplace (formerly FM Systems) from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 4.0)6.5Medium
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | OpenBlue Workplace (formerly FM Systems) | 0 – through 2025.1.2 |
Weakness: CWE-425 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U