CVE-2025-26381

MEDIUM

Johnson Controls OpenBlue Workplace < 2025.1.2 - Unauthorized Information Access via Forced Browsing

Title source: llm

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.

Core 2

Core References

Various Sources

Third Party Advisory, US Government Resource

CVSS v4 6.5

EPSS 0.0028

EPSS Percentile 19.6%

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

CWE

CWE-425

Status published

Products (1)

Johnson Controls/OpenBlue Workplace (formerly FM Systems) < 2025.1.2

Published Dec 17, 2025

Tracked Since Feb 18, 2026