Vulnerability · Published Jul 23, 2026 · Assigned by jci
CVE-2026-21653CCure and Victor Application Server - Server Side Request Forgery
High 7.2
In plain English
A high-severity server-side request forgery in CCure 9000 and victor application server from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 4.0)7.2High
Exploit odds (30 days)0.4%top 66.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | CCure 9000 and victor application server | 2.9 – through 3.0 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L