VULNERABILITY INTELLIGENCE
CVE-2026-21655
EPSS probability0.49%
CISA KEVNot currently listed
Published2026-07-23
Last modified2026-10-24
Description
Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.
Weakness classification
- productsecurity@jci.com: CWE-502