C-CURE 9000 and Victor application server - Deserialization of Untrusted Data
Priority MEDIUM 40CWE-502Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00492 42nd percentileScored 2026-11-07
Fix Fixed victor (Johnson Control): 8.0CCure 9000 (Johnson Controls): 3.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Johnson Control | victor | before 8.0 | 8.0 | Patch available | CNA |
| Johnson Controls | CCure 9000 | before 3.2 | 3.2 | Patch available | CNA |
| Johnson Controls | Victor Application Server | before 4.1 | 4.1 | Patch available | CNA |
- victor VendorJohnson Control Affected before 8.0 Fixed in 8.0 Patch available CNA
- CCure 9000 VendorJohnson Controls Affected before 3.2 Fixed in 3.2 Patch available CNA
- Victor Application Server VendorJohnson Controls Affected before 4.1 Fixed in 4.1 Patch available CNA
Remediation
- Fix · CNA victor (Johnson Control) Fixed in 8.0
- Fix · CNA CCure 9000 (Johnson Controls) Fixed in 3.2
- Fix · CNA Victor Application Server (Johnson Controls) Fixed in 4.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-21655
- 2026-10-03 Alias added: GHSA-g8rm-mhj7-46cg
References
More Johnson Control vulnerabilities
- TI-2025-28451 OS command injection in Johnson Control iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2… CVSS 4.0HIGH 8.7
Sources
- CVE-2026-21655 · CVE Program
- CVE-2026-21655 · NVD
- FIRST EPSS
- GHSA-g8rm-mhj7-46cg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences