Johnson Controls C-CURE 9000 and Victor application server (Update A)

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2026-21653, CVE-2026-21655, CVE-2026-34496. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server (Update A) are affected:

C-CURE 9000 <=v3.10.1 (CVE-2026-21655) victor Application Server <=v4.10 (CVE-2026-21655) victor <=v7.0 (CVE-2026-21655) victor Web victor Web <=v7.1 (CVE-2026-34496)

CVSS Vendor Equipment Vulnerabilities

v3 9.6 Johnson Controls Johnson Controls C-CURE 9000 and Victor application server (Update A) Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges

Background

Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland

Vulnerabilities

Expand All +

CVE-2026-21655

Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on an adjacent network to achieve arbitrary code execution on the C-CURE 9000, victor application server and victor, as well as connected clients (e.g., workstations of physical security personnel). Such attack could impact physical security controls. View CVE Details

Affected Products Johnson Controls C-CURE 9000 and Victor application server (Update A)

Vendor:Johnson Controls Product Version:Johnson Controls C-CURE 9000: <=v3.10.1, Johnson Controls victor Application Server: <=v4.10, Johnson Controls victor: <=v7.0 Product Status:known_affected

Remediations Vendor fixJohnson Controls recommends the following upgrades to address the vulnerable …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2026-21653, CVE-2026-21655, CVE-2026-34496): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-01
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.