Login Request a demo
High severity · published Jul 23, 2026
CVE-2026-21653
CCure and Victor Application Server - Server Side Request Forgery
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C9
CCure 9000 and victor application server · Johnson Controls
2.9 through 3.0 · source: vendor
Affected product
C9
CCure 9000 and victor application server
Johnson Controls
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21653
www.johnsoncontrols.com
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories