Advisories › Johnson Controls › ICSA-26-204-01
Johnson Controls C-CURE 9000 and Victor application server (Update A): 3 CVEs, Critical 9.6
Summary
CISA reports 3 vulnerabilities in Johnson Controls C-CURE 9000, victor Application Server, victor, victor Web. Weakness types: Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges. Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. Highest CVSS v3 score: 9.6 (Critical), exploitable from an adjacent network.
What to do: Prioritize: Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade to C-CURE 9000 v3.20 or later
At a glance
- Vendor
- Johnson Controls
- Products
- C-CURE 9000, victor Application Server, victor, victor Web
- CVEs
- CVE-2026-21655, CVE-2026-21653, CVE-2026-34496
- Highest CVSS v3
- 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Ireland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-21655 | Server-Side Request Forgery (SSRF) | 9.6 | – | No | Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on an adjacent network to achieve arbitrary code execution on the C-CURE 9000, victor application server and victor, as well as connected clients (e.g., workstations of physical security personnel). Such attack could impact physical security controls. |
| CVE-2026-21653 | Server-Side Request Forgery (SSRF) | 9.6 | – | No | Under certain circumstances, successful exploitation of this vulnerability could allow an attacker to forge server-side HTTP requests from the victor Web application. This could be leveraged to interact with internal services running on the host or accessible on the local network, potentially leading to unauthorized information disclosure or lateral movement within the network. |
| CVE-2026-34496 | Execution with Unnecessary Privileges | 8.0 | – | No | Under certain circumstances, successful exploitation of this vulnerability could result in low privilege users accessing unauthorized pages such as Users and Logs. Successful exploitation could allow an attacker to view sensitive system information, user account details, and audit logs beyond their intended access level, potentially enabling further attacks or unauthorized administrative actions. |
Affected products (5)
- Johnson Controls C-CURE 9000: <=v3.10.1
- Johnson Controls victor Application Server: <=v4.10
- Johnson Controls victor: <=v7.0
- Johnson Controls victor Web: <v7.0
- Johnson Controls victor Web: <=v7.1
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade to C-CURE 9000 v3.20 or later
- Vendor Fix: Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade victor Application Server to v4.20 or later
- Vendor Fix: Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade victor to v8.0 or later
- Mitigation: Johnson Controls recommends the following defensive measures to help reduce the risk of exploitation. Johnson Controls recommends following both steps in the mitigation guidance. However, until an upgrade is completed, the defensive measures outlined will reduce the attack surface: Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments. Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targ
- Mitigation: For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.