Which versions of Johnson Controls victor are affected by CVE-2026-21655?

Johnson Controls victor video management software versions 2.9 is vulnerable to unauthenticated object injection via network deserialization, allowing adjacent-network attackers to fully compromise…. A patch is available.

How to fix or mitigate CVE-2026-21655?

Within 24 hours, inventory all systems running Johnson Controls victor versions 2.9 and restrict network access to video management interfaces through firewall rules or VLAN isolation to limit exposure to adjacent-network attackers only. Within 7 days, implement mandatory network segmentation ensuring victor 2.9 systems reside on isolated network segments with minimal trust from user networks, and establish monitoring for unusual deserialization activity. Within 30 days, upgrade all victor 2.9 installations to version 3.0 or later when released, or implement vendor-recommended compensating controls; if upgrade timelines extend beyond 60 days, initiate evaluation of alternative video management solutions with better security patch velocity.

Johnson Controls victor CVE-2026-21655

Q: What is the CVSS score of CVE-2026-21655?

CVE-2026-21655 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-48423 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-23 jci

GHSA-g8rm-mhj7-46cg

Deserialization Microsoft Victor

8.7

CVSS 4.0 · Vendor: jci

Severity by source

Vendor (jci) PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Adjacent-network deserialization requiring no auth or interaction maps to AV:A/AC:L/PR:N/UI:N; full host compromise gives C:H/I:H/A:H with no scope change (S:U).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jci).

CVSS VectorVendor: jci

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 23:03 EUVD

Analysis Generated

Jul 23, 2026 - 20:50 vuln.today

CVE Published

Jul 23, 2026 - 20:13 cve.org

HIGH 8.7

DescriptionCVE.org

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586.

This issue affects victor: from 2.9 before 3.0.

AnalysisAI

Deserialization of untrusted data in Johnson Controls victor video management software (versions 2.9 up to but not including 3.0) on Windows allows an adjacent-network attacker to trigger object injection (CAPEC-586) and achieve high impact on confidentiality, integrity, and availability. The CVSS 4.0 vector (AV:A/PR:N/UI:N) indicates unauthenticated exploitation is possible for an attacker positioned on the same local network segment, with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

victor is Johnson Controls' (American Dynamics) enterprise video management system (VMS) client/server software used to manage IP video surveillance, recorders, and access-control integrations, running on the Windows platform (CPE cpe:2.3:a:johnson_control:victor). The root cause is CWE-502, Deserialization of Untrusted Data: the application deserializes attacker-supplied serialized objects without adequate type validation, enabling object injection. On the .NET/Windows stack this class of flaw typically arises from BinaryFormatter, SoapFormatter, or similar deserializers processing network-delivered payloads, allowing a crafted object graph to execute unintended logic or code during or after deserialization (CAPEC-586, Object Injection).

RemediationAI

Upgrade Johnson Controls victor to version 3.0 or later, which is the first release outside the affected range (from 2.9 before 3.0) and remediates the deserialization flaw; consult the Johnson Controls advisory at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories for the exact patched build and upgrade guidance. Until 3.0 can be deployed, restrict network reachability of victor hosts by isolating the video management system onto a dedicated, firewalled VLAN and permitting only trusted management workstations and cameras/recorders to communicate with it, since the adjacent-network (AV:A) vector means limiting who shares the local segment directly reduces exploitability; be aware this segmentation may disrupt integrations that rely on broader network access and should be validated against operational workflows. Also enforce strict access control on the physical/security network and monitor for anomalous connections to victor service ports.