Vendor
Johnson Controls
- articles · all time
- 3
- CVEs tracked · all time
- 4
- outlets · last 12 months
- 2
Products: AC2000, CCure 9000, CCure 9000 and victor application server, victor and 1 more
AC2000CCure 9000CCure 9000 and victor application servervictorVictor Application Server
CVEs
4 CVEsCVE-2026-21655C-CURE 9000 and Victor application server - Deserialization of Untrusted DataCVSS8.7High–Not in KEV0.5%EPSS1article
CVE-2026-21653CCure and Victor Application Server - Server Side Request ForgeryCVSS7.2High–Not in KEV0.4%EPSS1article
CVE-2025-26385Metasys product command injection vulnerability could allow remote SQL executionCVSSUnrated–Not in KEV1.5%EPSS1article
- Johnson Controls apps flaw CVE-2026-21653 enables RCESecurityOnline
- CISA alerts to DLL hijack flaw in Johnson Controls AC2000CISA · official notice
- Smart Buildings at Risk: Critical Johnson Controls Flaw (CVSS 10) Allows Remote SQL InjectionSecurityOnline · first in our coverage