Johnson Control vulnerabilities

Products

• iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, iSTAR Edge G2 1
• victor 1

Latest Johnson Control CVEs

Newest publication first

1. CVE-2026-21655 C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

   Published 2026-07-23

   High·CVSS 8.7 EPSS 0.49%

   Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1...

2. CVE-2025-43873 iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - setFaultDebounce

   Published 2025-12-17

   High·CVSS 8.7 EPSS 0.29%

   Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.