Skip to content
OpenAdvisories
High · 7.2 CVE-2026-21653 EUVD-2026-48425GHSA-v48g-g9wj-ffhr

CCure and Victor Application Server - Server Side Request Forgery

Published Jul 23, 2026 · Updated Jul 24, 2026 · Assigned by jci

Vendor: Johnson Controls Product: CCure 9000 and victor application server

Description

Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery.

This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.

Affected products

VendorProductAffectedFixed
Johnson Controls CCure 9000 and victor application server 2.9 – ≤ 3.0 —

Advisories 1

References