CVE-2026-21655: C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-23 · updated 2026-10-24
Weakness: CWE-502

Description

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

Affected products

Johnson Control victor: before 8.0 — fixed in 8.0
Johnson Controls CCure 9000: before 3.2 — fixed in 3.2
Johnson Controls Victor Application Server: before 4.1 — fixed in 4.1

How to fix

Upgrade to a fixed version: Johnson Control victor 8.0; Johnson Controls CCure 9000 3.2; Johnson Controls Victor Application Server 4.1. Check the vendor advisory for mitigations.

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Get alerted when CVE-2026-21655 or the next vulnerability affects your stack