Johnson Controls C-CURE 9000 and Victor application server (Update A)

TL;DR

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server (Update A) are affected: C-CURE 9000 <=v3.10.1 (CVE-2026-21655) victor Application Server <=v4.10 (CVE-2026-21655) victor <=v7.0 (CVE-2026-21655) victor Web victor Web <=v7.1 (CVE-2026-34496) CVSS Vendor Equipment Vulnerabilities

v3 9.6 Johnson Controls Johnson Controls C-CURE 9000 and Victor application server (Update A) Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges

Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland Vulnerabilities Expand All + CVE-2026-21655 Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on an adjacent network to achieve arbitrary code execution on the C-CURE 9000, victor application server and victor, as well as connected clients (e.g., workstations of physical security personnel). Such attack could impact physical security controls. View CVE Details Affected Products Johnson Controls C-CURE 9000 and Victor application server (Update A) Vendor: Johnson Controls Product Version: Johnson Controls C-CURE 9000: <=v3.10.1, Johnson Controls victor Application Server: <=v4.10, Johnson Controls victor: <=v7.0 Product Status: known_affected Remediations Vendor fix Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade to C-CURE 9000 v3.20 or later Vendor fix Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade victor Application Server to v4.20 or later Vendor fix Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade victor to v8.0 or later Mitigation Johnson Controls recommends the

What Happened

Johnson Controls C-CURE 9000 and Victor application server (Update A), reported by CISA.

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server (Update A) are affected: C-CURE 9000 <=v3.10.1 (CVE-2026-21655) victor Application Server <=v4.10 (CVE-2026-21655) victor <=v7.0 (CVE-2026-21655) victor Web victor Web <=v7.1 (CVE-2026-34496) CVSS Vendor Equipment Vulnerabilities

v3 9.6 Johnson Controls Johnson Controls C-CURE 9000 and Victor application server (Update A) Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges

Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland Vulnerabilities Expand All + CVE-2026-21655 Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on an adjacent network to achieve arbitrary code execution on the C-CURE 9000, victor application server and victor, as well as connected clients (e.g., workstations of physical security personnel). Such attack could impact physical security controls. View CVE Details Affected Products Johnson Controls C-CURE 9000 and Victor application server (Update A) Vendor: Johnson Controls Product Version: Johnson Controls C-CURE 9000: <=v3.10.1, Johnson Controls victor Application Server: <=v4.10, Johnson Controls victor: <=v7.0 Product Status: known_affected Remediations Vendor fix Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade to C-CURE 9000 v3.20 or later Vendor fix Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade victor Application Server to v4.20 or later Vendor fix Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade victor to v8.0 or later Mitigation Johnson Controls recommends the

For the full technical details, see the original report.

Why It Matters for Businesses

This development could affect organizations that rely on the impacted technologies or services. Unpatched systems, misconfigured infrastructure, or lack of monitoring can leave businesses exposed to exploitation, data breaches, and regulatory penalties.

How to Check Your Exposure

Run a free scan on NEL Professional's Cyber Risk Scanner to check whether your domain is affected. The scan covers SSL/TLS, security headers, DNS configuration, email authentication, and more across 16 modules.

Check Your Domain Security

Mitigation Steps

• Patch immediately, Apply vendor patches or updates as soon as they are available.
• Review configurations, Check firewall rules, access controls, and security headers.
• Monitor logs, Watch for indicators of compromise (IOCs) related to this threat.
• Update security policies, Ensure incident response plans cover this type of threat.
• Run a security scan, Use automated tools to verify your exposure.

Need Expert Help?

If your organization needs help assessing or remediating this issue, hire a verified cybersecurity specialist through NEL Professionals.

Get up to 100 scans or unlimited lifetime access starting at $15.

Comments (0)

No comments yet. Be the first to comment!