CVE-2026-21653

Johnson Controls CCure 9000 and Victor Application Server are affected by a SSRF vulnerability (CVE-2026-21653) impacting versions 2.9 through 3.0. The issue enables Server-Side Request Forgery due to an insecure handling of external requests within the Victor application server. CVSS 4.0 base sc...

CVE-2026-21655

CVE-2026-21655 describes a deserialization of untrusted data vulnerability in Johnson Controls Victor on Windows, affecting Victor versions 2.9 prior to 3.0. The issue arises from deserializing untrusted data in the Victor application server, leading to high impact on confidentiality, integrity, ...