CVE-2026-21653

Published: Lug 23, 2026 Last Modified: Lug 24, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 7,2

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: high

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

AI Translation Available

Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery.

This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.

918

Incomplete

Abstraction: Base Structure: Simple

Security Scopes Affected:

Confidentiality Integrity Access Control

Potential Impacts:

Read Application Data Execute Unauthorized Code Or Commands Bypass Protection Mechanism

Technologies: Web Based, AI/ML, Web Server

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories