CISA published an ICS advisory detailing three vulnerabilities in Johnson Controls C-CURE 9000 and Victor application server products. CVE-2026-21655 is a critical .NET deserialization flaw (CVSS 9.6) allowing unauthenticated adjacent-network attackers to achieve remote code execution on port 8999. CVE-2026-21653 is a critical SSRF in Victor Web enabling server-side request forgery against internal services. CVE-2026-34496 is a high-severity privilege issue allowing low-privilege Victor Web users to view unauthorized administrative pages. Vendor upgrades are available for all affected products.
C-CURE 9000
1 post
Johnson Controls C-CURE 9000 and Victor application server (Update A) (CVE-2026-21655, CVE-2026-34496, CVE-2026-21653)