Deserialization in Johnson Control Victor

CVE-2026-21655

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0.

Vulnerability class: Insecure Deserialization

Affected products

Johnson Control Victor — versions 2.9

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

productsecurity@jci.com (vendor-advisory)