Deserialization in Johnson Control Victor
CVE-2026-21655
Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.
Vulnerability class: Insecure Deserialization
EPSS: 0.005 (40.5th percentile) — read the EPSS interpretation.
Affected products
- Johnson Control Victor — versions 2.9, 0
- Johnson Controls Ccure 9000 — versions 0
- Johnson Controls Victor Application Server — versions 0
Weakness classification (CWE)
References
- productsecurity@jci.com (vendor-advisory)