Critical Vulnerabilities Discovered in Johnson Controls C-CURE 9000 and Victor Application Server

The Cybersecurity and Infrastructure Security Agency (CISA) has published an Industrial Control Systems advisory (ICSA-26-204-01) detailing multiple vulnerabilities in Johnson Controls C-CURE 9000 and Victor application server software. The advisories, also referenced through Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16, highlight significant risks to critical manufacturing infrastructure worldwide.

CVE-2026-21655 is the most severely rated vulnerability, with a CVSS v3.1 base score of 9.6 (CRITICAL). It involves a vulnerable deserialization path that could allow an unauthenticated attacker on an adjacent network to achieve arbitrary code execution on C-CURE 9000, the victor application server, and victor products. Such exploitation could impact physical security controls connected to these systems. CVSS v4.0 also rates this vulnerability at 9.4, with the vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

CVE-2026-34496 affects victor Web versions up to v7.1 and involves SSRF that could allow an attacker to forge server-side HTTP requests. This could be leveraged to interact with internal services running on the host or accessible on the local network, potentially leading to unauthorized information disclosure or lateral movement within the network.

CVE-2026-21653, while not assigned a CVSS score in the provided excerpt, is described as allowing an attacker to forge server-side HTTP requests from the victor Web application, which could be leveraged to interact with internal services, leading to unauthorized information disclosure or lateral movement.

Affected product versions include Johnson Controls C-CURE 9000 <= v3.10.1, victor Application Server <= v4.10, victor <= v7.0, and victor Web <= v7.1. Johnson Controls recommends upgrading C-CURE 9000 to v3.20 or later, upgrading victor Application Server to v4.20 or later, upgrading victor to v8.0 or later, and upgrading victor Web to v7.0 or later to address the vulnerabilities.

Until upgrades are completed, Johnson Controls recommends defensive mitigation measures including implementing strict firewall rules to block unnecessary inbound connections to port 8999 from untrusted network segments, deploying IDS/IPS signatures tuned to detect .NET deserialization exploit patterns (e.g., ysoserial.net patterns), enforcing application whitelisting on application server hosts, ensuring the application server process runs with least privilege, enabling detailed logging and monitoring for anomalous process creation, and disabling unnecessary services such as the ClientConnectionManager_NF.SynchronousServerNotification callback interface if not required.

The vulnerabilities affect Critical Manufacturing sector infrastructure deployed worldwide, with the vendor company headquartered in Ireland. No confirmation of active exploitation in the wild was provided, though the high CVSS scores and unauthenticated access vectors present significant risk.