Which versions of victor Web are affected by CVE-2026-34496?

Johnson Controls Victor Web, a Windows-based video management client, contains a privilege escalation flaw (CVE-2026-34496, CVSS 7.1) allowing authenticated high-privileged users to access system…. A patch is available.

How to fix or mitigate CVE-2026-34496?

Within 24 hours, inventory all Victor Web deployments and document current versions across the organization. Within 7 days, apply the Victor Web 7.1 security update to all systems-download from Johnson Controls advisory channels and validate compatibility with existing video management configurations before deployment. Within 30 days, complete full regression testing of video management functionality, verify privilege controls are properly enforced post-update, and audit logs for any unauthorized access attempts.

victor Web CVE-2026-34496

Q: What is the CVSS score of CVE-2026-34496?

CVE-2026-34496 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-48427 HIGH

Improper Privilege Management (CWE-269)

2026-07-23 jci

GHSA-f4xv-vq6q-4wwv

Privilege Escalation Microsoft Victor Web Johnson Controls

7.1

CVSS 4.0 · Vendor: jci

Severity by source

Vendor (jci) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Requires a high-privilege authenticated account (PR:H) and non-trivial conditions (AC:H) over the network; privilege boundary crossing gives S:C with high confidentiality and low integrity/availability impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L

Primary rating from Vendor (jci).

CVSS VectorVendor: jci

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 23:03 EUVD

Analysis Generated

Jul 23, 2026 - 21:16 vuln.today

CVE Published

Jul 23, 2026 - 20:26 cve.org

HIGH 7.1

DescriptionCVE.org

Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233.

This issue affects victor Web: before 7.1.

AnalysisAI

Privilege management weakness in Johnson Controls victor Web (video management client) on Windows lets a high-privileged, authenticated actor abuse improper privilege controls (CWE-269 / CAPEC-233) to access information beyond its authorization boundary, with the impact crossing into a subsequent system component. It affects all victor Web releases before 7.1 and is fixed in 7.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with high attack complexity and a required attack condition, indicating exploitation is non-trivial.

Technical ContextAI

victor Web is the browser-based front end of Johnson Controls' victor / American Dynamics VideoEdge video management system, used to view and administer physical-security camera infrastructure on Windows hosts. The root cause is CWE-269 (Improper Privilege Management): the application does not correctly enforce the boundary between privilege levels, so an operator-level or otherwise privileged account can obtain access or data that should be reserved for a higher trust level. The associated CAPEC-233 (Privilege Escalation) pattern and the CVSS scope/subsequent-system metrics (SC:H) indicate the improperly managed privilege can affect resources outside the immediately vulnerable component. The affected component is identified by CPE cpe:2.3:a:johnson_controls:victor_web:*:*:*:*:*:*:*:*; the input lists CWE as N/A but the description explicitly cites CWE-269.

RemediationAI

Upgrade victor Web to version 7.1 or later, which the advisory scope ('affects victor Web: before 7.1') identifies as the fixed release - patch status here is best described as vendor-released patch: version 7.1. Consult the Johnson Controls advisory at https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories for the exact build and upgrade guidance. Until 7.1 is deployed, reduce exposure by restricting network access to the victor Web interface to trusted management VLANs or a jump host (trade-off: legitimate remote operators must connect through the restricted path), tightening role assignments so no account holds more privilege than its function requires (trade-off: operational friction for multi-role users), and increasing audit logging on privileged victor Web actions to detect misuse (trade-off: added log review workload). Because exploitation requires an already high-privileged account, enforcing least privilege and reviewing who holds elevated victor Web roles is the most effective compensating control.