CVE-2026-21655 — C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

CVE-2026-21655

C-CURE 9000 and Victor application server - Deserialization of Untrusted Data PUBLISHED

Description (CNA)

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

Affected (CNA)

Vendor / product	Versions
Johnson Control / victor	affected 0 before 8.0
Johnson Controls / CCure 9000	affected 0 before 3.2
Johnson Controls / Victor Application Server	affected 0 before 4.1

CWE

CWE-502

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.