CVE-2026-21655 describes a vulnerability in Johnson Control victor on Windows where deserialization of untrusted data can be exploited. The affected version is exactly 2.9. The CVSS 4.0 base score is 8.7, indicating high severity, with attack vector being adjacent network and no required privileges or user interaction. The vulnerability impacts confidentiality, integrity, and availability with high impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation could lead to significant compromise of system confidentiality, integrity, and availability due to unsafe deserialization of untrusted data. The vulnerability can be exploited remotely over an adjacent network without privileges or user interaction, making it a serious risk for affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected service and monitor for unusual activity related to deserialization processes.