This vulnerability (CVE-2026-21653) in Johnson Controls CCure 9000 and victor application server allows an attacker with high privileges to perform Server Side Request Forgery (SSRF). The affected versions include 2.9 through 3.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack traceability, high impact on confidentiality and security, and low impact on integrity and availability. No official remediation or patch has been documented yet.

An attacker with high privileges can exploit this SSRF vulnerability to cause the server to make unauthorized requests, potentially leading to information disclosure or interaction with internal systems that are otherwise inaccessible. The impact on confidentiality and security is high, while integrity and availability impacts are low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application servers to trusted administrators only and monitor for unusual request patterns that may indicate SSRF attempts.