Deserialization Vulnerability in Johnson Controls Victor on Windows
CVE-2026-21655

8.7HIGH

Key Information:

Vendor

Johnson Control

Status
Victor
Ccure 9000
Victor Application Server
Vendor
CVE Published:
23 July 2026

What is CVE-2026-21655?

A deserialization of untrusted data vulnerability has been identified in Johnson Controls' Victor software running on Windows. This issue allows for exploitation by improperly handling deserialized data, potentially permitting unauthorized access or actions within the application. The vulnerability affects versions of Victor starting from 2.9 leading up to, but not including, 3.0. Organizations using these versions should take immediate action to mitigate risks associated with this security flaw.

Affected Version(s)

CCure 9000 0 < 3.2

Victor Application Server 0 < 4.1

victor Windows 0 < 8.0

References

https://www.johnsoncontrols.com/trust-center/cybersecurit...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.