CVE-2026-21655: C-CURE 9000 and Victor application server - Deserialization of Untrusted Data
Published Jul 23, 2026
·Updated
Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586.
This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.
Affected Software
3 affected components
Johnson Controls Victor<8.0
Johnson Controls C-CURE 9000<3.2
Johnson Controls victor application server<4.1
Event History
Jul 23, 2026
CVE Published
via MITRE·08:13 PM
Data Sourced
via MITRE·08:13 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-21655?
CVE-2026-21655 has a severity rating of high at 8.7 based on its CVSS score.
2
How do I fix CVE-2026-21655?
To fix CVE-2026-21655, update the Victor application server to version 3.0 or later.
3
What systems are impacted by CVE-2026-21655?
CVE-2026-21655 affects the Victor application server, specifically from versions 2.9 before 3.0.
4
What type of vulnerability is CVE-2026-21655?
CVE-2026-21655 is categorized as a deserialization of untrusted data vulnerability.
5
When was CVE-2026-21655 published?
CVE-2026-21655 was published on July 23, 2026.