CVE-2026-21655: Johnson Control Victor

High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

Affected products

• Johnson Control Victor: before 8.0 (fixed in 8.0)
• Johnson Controls Ccure 9000: before 3.2 (fixed in 3.2)
• Johnson Controls Victor Application Server: before 4.1 (fixed in 4.1)

Published 2026-07-23. Last modified 2026-08-06.