Johnson Control
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 | 1 | – | Dec 17, 2025 |
| victor | 1 | – | Jul 23, 2026 |
Exploited and recent CVEs
- CVE-2026-21655 C-CURE 9000 and Victor application server - Deserialization of Untrusted Data 0.5%
- CVE-2025-43873 iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - setFaultDebounce 0.3%