C-CURE 9000 Vulnerability CVE-2026-21655 Enables Remote Code Execution, CVE-2026-21653 Scores CVSS 9.6
Do Son 
TL;DR
CISA published ICS advisory ICSA-26-204-01 on July 23, 2026. It covers three flaws in Johnson Controls C-CURE 9000 and victor application servers. The most severe C-CURE 9000 vulnerability, CVE-2026-21653, carries a CVSS v3.1 score of 9.6, while CVE-2026-21655 leads to remote code execution.
- Product: Johnson Control victor, Johnson Controls CCure 9000 and victor application server +1
- Vulnerabilities: 3 flaws (CVE-2026-21655, CVE-2026-21653, CVE-2026-34496)
- Highest severity: 8.7 (High · CVSSv4)
- Worst impact: C-CURE 9000 and application server - Deserialization of Untrusted Data
- Status: No confirmed exploitation yet; patches available
- Action: Update to 3.0, 7.1 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-21655 | 8.7 | C-CURE 9000 and application server - Deserialization of Untrusted Data | 3.0 | Not exploited |
| CVE-2026-21653 | 7.2 | CCure and Victor Application Server - Server Side Request Forgery | — | Not exploited |
| CVE-2026-34496 | 7.1 | Priviledge Escalation | 7.1 | Not exploited |
Why It Matters
C-CURE 9000 runs door controls, badge readers, and alarm logic for large facilities. An attacker who executes code on that server can touch physical security itself. Johnson Controls also warns that connected clients are at risk, including the workstations used by security staff. A software bug therefore becomes a doors-and-locks problem, not just an IT problem.
How the Attack Works
CVE-2026-21655 abuses a deserialization path reachable over port 8999. Under certain conditions, an unauthenticated attacker on the adjacent network gains arbitrary code execution on the application server and on connected clients.
CVE-2026-21653 is a server-side request forgery issue, tracked as CWE-918. The victor Web application can be tricked into sending requests on the attacker’s behalf. Internal services then become reachable, which enables information disclosure and lateral movement.
CVE-2026-34496 falls under CWE-250, execution with unnecessary privileges. Low-privilege users can open restricted pages such as Users and Logs. That exposes account details and audit records well beyond their intended access level. CISA reports no known public exploitation of these flaws, and no public proof-of-concept has been confirmed.
Affected Versions
C-CURE 9000 and victor up to v2.90_v3.0 are affected. So is victor Web up to and including v7.1.
Patch and Mitigation Steps
Upgrade C-CURE 9000 and victor to version 3.20 or later. Update victor Web installations to version 7.0 or later, a fix the vendor validated through independent retest.
Harden the servers afterward. Isolate them on a dedicated segment, and restrict port 8999 to authorized systems only. Tune IDS/IPS signatures for .NET deserialization payloads, enforce application whitelisting, and run the server process with least privilege. Watch for unusual process creation by SoftwareHouse.CrossFire.Server.exe. Disable the ClientConnectionManager_NF.SynchronousServerNotification callback interface if your deployment does not need it. Johnson Controls documents the details in advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16, and CISA advisory ICSA-26-204-01 adds defensive guidance for this C-CURE 9000 vulnerability set.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
