Which versions of CCure 9000 are affected by CVE-2026-21653?

Johnson Controls CCure 9000 and victor application server versions 2.9-3.0 contain a Server-Side Request Forgery vulnerability that enables attackers to coerce these servers into issuing requests to…

How to fix or mitigate CVE-2026-21653?

Within 24 hours, verify which systems run Johnson Controls CCure 9000 or victor versions 2.9-3.0 and immediately restrict network access to those systems to essential personnel only; document the complete inventory. Within 7 days, implement network-level egress filtering to prevent these servers from reaching unexpected internal resources, enable comprehensive logging of server access and configuration changes, and contact Johnson Controls support to confirm patch availability and timelines. Within 30 days, evaluate and plan upgrades to versions outside the 2.9-3.0 range or alternative solutions, and ensure readiness to deploy vendor patches immediately upon release.

CCure 9000 CVE-2026-21653

Q: What is the CVSS score of CVE-2026-21653?

CVE-2026-21653 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-48425 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-23 jci

GHSA-v48g-g9wj-ffhr

SSRF Ccure 9000 And Victor Application Server Johnson Controls

7.2

CVSS 4.0 · Vendor: jci

Severity by source

Vendor (jci) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable SSRF needing high privileges (PR:H) and a specific condition (AC:H mapping the 4.0 AT:P), with scope change (S:C) since forged requests hit other systems; high confidentiality, limited integrity/availability.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L

Primary rating from Vendor (jci).

CVSS VectorVendor: jci

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:15 vuln.today

CVE Published

Jul 23, 2026 - 20:19 cve.org

HIGH 7.2

DescriptionCVE.org

Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery.

This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.

AnalysisAI

Server-Side Request Forgery in Johnson Controls CCure 9000 and the victor application server (versions 2.9 through 3.0) allows a high-privileged authenticated attacker to coerce the server into issuing crafted requests to internal or external systems. Exploitation can expose internal network resources and pivot into otherwise unreachable back-end services, with high confidentiality impact and a scope change that affects downstream systems. This is a vendor-reported (jci) issue with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

CCure 9000 is Johnson Controls' enterprise physical access control and security management platform, and the victor application server is the companion video/event management application server. The flaw is a Server-Side Request Forgery weakness (CWE-918 class, though the input lists CWE as N/A) in which the application server takes an attacker-influenced URL or address and performs a request to it without sufficient validation of the destination. Because these servers typically sit inside a trusted management network with connectivity to controllers, databases, and other appliances, an SSRF primitive lets the server act as a proxy into that trusted zone. The CVSS 4.0 subsequent-system metrics (SC:H/SI:H) reflect that the coerced requests reach systems beyond the vulnerable application itself.

RemediationAI

No exact fixed version is provided in the available data, so consult the Johnson Controls Trust Center advisory (https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories) for the specific patched release covering CCure 9000 and victor application server and upgrade beyond the affected 2.9-3.0 range; patch status: patch available per vendor advisory, with no independently confirmed fix version. As compensating controls until patching, restrict network access to the application server management interface to a dedicated administrative VLAN and trusted operator hosts only, apply strict egress filtering / an allow-list so the server can only reach the specific internal systems it legitimately needs (blocking SSRF pivots to arbitrary internal addresses and cloud metadata endpoints), and tightly limit and audit the high-privilege accounts required to reach the vulnerable function since exploitation needs PR:H. The trade-off of aggressive egress filtering is potential disruption to legitimate integrations (video servers, directory services, controllers), so validate the allow-list against documented dependencies before enforcing.