CVE-2026-21655

High

Description

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

SeverityHigh

CVSS8.7

Exploit probability—

ProductJohnson Control Victor

PublishedJul 23, 2026

First seenJul 23, 2026

Weakness typeCWE-502Deserialization of untrusted data

How to fix

Update

Johnson Control victor8.0 or later
Johnson Controls CCure 90003.2 or later
Johnson Controls Victor Application Server4.1 or later

Vendor advisories

johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Affected products

Product	Affected versions	Fixed in
Johnson Control victor	v < 8.0	8.0
Johnson Controls CCure 9000	v < 3.2	3.2
Johnson Controls Victor Application Server	v < 4.1	4.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.