CCure 9000 CVE-2026-21653

Exploitation requires an authenticated high-privilege account on the CCure 9000 or victor application server (CVSS PR:H) plus a specific attack requirement (AT:P) that is not detailed in the description - verify the exact triggering condition against the vendor advisory. The attacker must be able to reach the application server over the network (AV:N) and supply an attacker-controlled destination to a server-side request feature. Limiting factors: the need for high privileges sharply narrows the realistic attacker set to insiders or those who have already compromised a privileged credential, and the AT:P condition means default or arbitrary deployments may not be exploitable without that specific state; no user interaction is required (UI:N).

The CVSS 4.0 base score is 7.2 (High) with vector AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L, meaning the attack is network-reachable and low-complexity but requires high privileges (PR:H) and a specific attack requirement/condition (AT:P) to succeed. There is no EPSS score provided, no POC referenced, and no CISA KEV listing, so real-world exploitation appears unproven and gated behind existing privileged access - this lowers practical urgency relative to the raw High score. The most significant risk driver is the scope/subsequent-system impact (SC:H/SI:H): an SSRF from a physical-security management server can breach network segmentation. Net assessment: a genuine but conditional risk best treated as an internal-threat / lateral-movement concern rather than a mass-exploitation emergency, given PR:H and AT:P. Note the AT:P attack requirement is not detailed in the description - verify the exact triggering condition with the vendor advisory.

An attacker who already holds a high-privileged operator or administrative account on the CCure 9000 / victor application server (or who has compromised such an account) submits a crafted request whose target address the server then contacts on the attacker's behalf. The server issues requests to internal systems the attacker cannot reach directly - internal APIs, databases, or metadata services - enabling reconnaissance and data disclosure across network segments. No public POC is referenced, and the AT:P attack requirement means a specific configuration or condition must also be met.