CVE-2026-21653
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected: C-CURE 9000 and victor <=v2.90_v3.0 victor Web <=v7.1 CVSS Vendor Equipment Vulnerabilities v3 9.6 Johnson Controls Johnson Controls C-CURE 9000 and Victor application server Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Ireland Vulnerabilities Expand All + CVE-2026-21655 Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on the adjacent network to achieve arbitrary code execution on the C-CURE 9000 or victor application server, as well as connected clients (e.g., workstations of physical security personnel). Such an attack could impact physical security controls. View CVE Details Affected Products Johnson Controls C-CURE 9000 and Victor application server Vendor: Johnson Controls Product Version: Johnson Controls C-CURE 9000 and victor: <=v2.90_v3.0 Product Status: known_affected Remediations Mitigation Johnson Controls recommends the following defensive measures to help reduce the risk of exploitation: (CVE-2026-21655) Upgrade to C-CURE 9000 / victor version 3.20 or later, which addresses the vulnerable deserialization path (LV1.1). Vendor fix Network segmentation - Isolate the C-CURE 9000 and victor application servers on a dedicated network segment and restrict access to port 8999 to only authorized systems that require connectivity. Mitigation Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments. Mitigation Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deser
CSIRTS triage
- What
- Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.
- Who is affected
- An unauthenticated attacker on the adjacent network can exploit the vulnerabilities in the affected versions.
- Urgency
- Remediation is critical due to the potential for remote code execution and the high severity rating.
- Action
- Apply the latest patches to the affected versions.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-21653
Get an email if CVE-2026-21653 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
Advisory coverage (2)
- unknownCVE-2026-21653: Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows …nvd · 2026-07-23
- criticalJohnson Controls C-CURE 9000 and Victor application servercisa · 2026-07-23
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-21653)