Skip to content
OpenAdvisories
Critical ICSA-26-204-01 3 CVEs

Johnson Controls C-CURE 9000 and Victor application server (Update A)

Published Jul 23, 2026 · Updated Aug 11, 2026 · Revision 2

Vendor: Johnson Controls Product: C-CURE 9000 Product: victor Product: Victor Application Server Product: victor Web

Summary

Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.

Vulnerabilities 3

  • High 8.7
    CVE-2026-21655

    C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

    Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Applicati…

    Johnson Controls Johnson Control victor Victor Application Server
  • High 7.2
    CVE-2026-21653

    CCure and Victor Application Server - Server Side Request Forgery

    Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.

    Johnson Controls CCure 9000 and victor application server
  • High 7.1
    CVE-2026-34496

    victor Web - Priviledge Escalation

    Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1.

    Johnson Controls victor Web

Revision history

  1. #2

    Update A - Made changes to affected products and mitigations.

  2. #1

    Initial Republication of Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16.

References