CVE-2026-21653 — CCure and Victor Application Server - Server Side Request Forgery

CVE-2026-21653

CCure and Victor Application Server - Server Side Request Forgery PUBLISHED

Description (CNA)

Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.

Affected (CNA)

Vendor / product	Versions
Johnson Controls / CCure 9000 and victor application server	affected 2.9 through 3.0

CWE

No CWE identifiers supplied.

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.