This vulnerability involves a Server Side Request Forgery (SSRF) in Johnson Controls CCure 9000 and victor application server, specifically affecting version 2.9. SSRF vulnerabilities allow an attacker to cause the server to send crafted requests to internal or external systems, potentially bypassing network restrictions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality and integrity. The vulnerability is published and assigned CVE-2026-21653 but currently lacks an official remediation level or patch from the vendor.

An attacker with high privileges on the affected system could exploit this SSRF vulnerability to make unauthorized requests from the server, potentially accessing or manipulating internal resources or data. The impact includes high confidentiality and integrity loss, with limited availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, organizations should monitor vendor communications for updates. Until a patch is available, restrict access to the affected application server to trusted users with high privileges to reduce exploitation risk.