Security & Threat Intelligence · 23.07.2026, 18:07 UTC
Johnson Controls C-CURE 9000 and Victor application server
| Schweregrad | info |
|---|---|
| CVE | ↗ ↗ ↗ |
| Kategorie | Security & Threat Intelligence |
| Quelle | CISA ICS Advisories · CISA Advisories ↗ |
| Veröffentlicht | 23.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2026-21653, CVE-2026-21655, CVE-2026-34496. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected:
C-CURE 9000 and victor <=v2.90_v3.0 victor Web <=v7.1
CVSS Vendor Equipment Vulnerabilities
v3 9.6 Johnson Controls Johnson Controls C-CURE 9000 and Victor application server Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges
Background
Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland
Vulnerabilities
Expand All +
CVE-2026-21655
Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on the adjacent network to achieve arbitrary code execution on the C-CURE 9000 or victor application server, as well as connected clients (e.g., workstations of physical security personnel). Such an attack could impact physical security controls. View CVE Details
Affected Products Johnson Controls C-CURE 9000 and Victor application server
Vendor:Johnson Controls Product Version:Johnson Controls C-CURE 9000 and victor: <=v2.90_v3.0 Product Status:known_affected
Remediations MitigationJohnson Controls recommends the following defensive measures to help reduce the risk of exploitation: (CVE-2026-21655) Upgrade to C-CURE 9000 / victor version 3.20 or later, which addresses the vulnerable deserialization path (LV1.1). Vendor fixNetwork segmentation - Isolate the C-CURE 9000 and victor …