Johnson Control vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Johnson Control products: 2 record(s), with severity, exploitation and fixes.

iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 1 Victor 1

Exploited only (KEV) →

CVE-2026-21655 High · 8.7 CWE-502 Jul 23, 2026

C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

CVE-2025-43873 High · 8.7 CWE-78 Dec 17, 2025

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - setFaultDebounce

Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device.