Vulnerability intelligence
CVE-2026-21653
Johnson Controls CCure 9000 and victor application server
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.
CVSS Score
7.2
High
EPSS — Exploit Probability
0.4%
Riskier than 32% of all CVEs · checked 2026-09-11
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
1 article across 1 outlet · first covered Jul 29, 2026 · latest Jul 29, 2026
Coverage timeline
-
Johnson Controls apps flaw CVE-2026-21653 enables RCEsecurityonline.info · Jul 29, 2026