Is CVE-2026-21653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21653 being exploited in the wild.

How severe is CVE-2026-21653?

Informational severity, with a CVSS score of 7.2, published 23 July 2026.

Which products and versions are affected?

Johnson Controls Victor Application Server 2.9 through 3.0.

Is there a fix for CVE-2026-21653?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-21653 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-21653?

Check whether you run Johnson Controls C·CURE 9000 or Johnson Controls Victor Application Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21653: Johnson Controls CCure 9000 and victor SSRF in Victor component

CVE-2026-21653 · Severity: info · CVSS 7.2 · Published 2026-07-23

A security vulnerability exists in the Johnson Controls CCure 9000 and victor application server, which are systems used for physical security and access control management. An attacker could potentially force the server to make unauthorized requests to internal or external systems, which could lead to the exposure of sensitive information or unauthorized access to internal network resources. This issue affects versions 2.9 through 3.0 of the software.

Vendors: Johnson Controls.

Quick answers

Is CVE-2026-21653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21653 being exploited in the wild.
How severe is CVE-2026-21653?: Informational severity, with a CVSS score of 7.2, published 23 July 2026.
Which products and versions are affected?: Johnson Controls Victor Application Server 2.9 through 3.0.
Is there a fix for CVE-2026-21653?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21653 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-21653?: Check whether you run Johnson Controls C·CURE 9000 or Johnson Controls Victor Application Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Victor component of Johnson Controls CCure 9000 and the victor application server. The flaw allows an authenticated attacker with high privileges (PR:H) to submit crafted requests that the server will execute on their behalf. This can be leveraged to interact with internal services that are otherwise unreachable from the external network or to exfiltrate sensitive data. The vulnerability is tracked as CVE-2026-21653 and has been assigned a CVSS 4.0 score of 7.2 by the vendor. Affected versions range from 2.9 to 3.0.

Affected products

Johnson Controls CCure 9000 2.9 through 3.0
Johnson Controls victor application server 2.9 through 3.0

Timeline

2026-07-23: advisory: NVD and vendor advisory published

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.