Is CVE-2026-21655 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-21655

Johnson Controls recommends upgrading C-CURE 9000 to v3.20 or later, upgrading victor Application Server to v4.20 or later, upgrading victor to v8.0 or later, and upgrading victor Web to v7.0 or later. Until upgrades are applied, implement strict firewall rules blocking unnecessary inbound connections to port 8999 from untrusted network segments, deploy IDS/IPS signatures tuned to detect .NET deserialization exploit patterns (e.g., ysoserial.net), enforce application whitelisting on application server hosts, ensure application server processes run with least privilege, enable detailed logging and monitor for anomalous process creation (e.g., SoftwareHouse.CrossFire.Server.exe), and disable unnecessary services such as the ClientConnectionManager_NF.SynchronousServerNotification callback interface if not required. See Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 for more detailed guidance.

Quick answers

What is CVE-2026-21655?: Johnson Controls recommends upgrading C-CURE 9000 to v3.20 or later, upgrading victor Application Server to v4.20 or later, upgrading victor to v8.0 or later, and upgrading victor Web to v7.0 or later. Until upgrades are applied, implement strict firewall rules blocking unnecessary inbound connections to port 8999 from untrusted network segments, deploy IDS/IPS signatures tuned to detect .NET deserialization exploit patterns (e.g., ysoserial.net), enforce application whitelisting on application server hosts, ensure application server processes run with least privilege, enable detailed logging and monitor for anomalous process creation (e.g., SoftwareHouse.CrossFire.Server.exe), and disable unnecessary services such as the ClientConnectionManager_NF.SynchronousServerNotification callback interface if not required. See Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 for more detailed guidance.
How severe is CVE-2026-21655?

Critical Vulnerabilities Discovered in Johnson Controls C-CURE 9000 and Victor Application Server

CISA and Johnson Controls have issued advisories regarding multiple critical vulnerabilities affecting C-CURE 9000 and Victor application server products. The vulnerabilities, primarily tracked as CVE-2026-21655, CVE-2026-34496, and CVE-2026-21653, involve server-side request forgery (SSRF) that could allow unauthenticated remote attackers to achieve arbitrary code execution, impact physical security controls, and facilitate lateral movement within networks. Affected versions span C-CURE 9000 up to v3.10.1, victor Application Server up to v4.10, victor up to v7.0, and victor Web up to v7.1. Johnson Controls has released vendor fixes recommending upgrades to newer versions to address the vulnerable deserialization paths.

12m

CVE-2026-21655

Quick answers

Related News

Critical Vulnerabilities Discovered in Johnson Controls C-CURE 9000 and Victor Application Server