Johnson Controls CCure 9000 and victor application server SSRF vulnerability in versions 2.9 through 3.0

Last refreshed2026-09-30

Status: NEW | Advisory ID: CVE-2026-21653

Key Details

CVE	CVE-2026-21653
CVSS Score / Version	7.2 (High) / CVSS v4.0
Updated	2026-07-30
Classified as	CWE-918 (Server-Side Request Forgery (SSRF))

Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery.

This issue affects CCure 9000 and victor application server: from 2.9 through 3.0. (NVD)

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-21653
CVE	https://www.cve.org/CVERecord?id=CVE-2026-21653

Source

Reference

NVD

CVE