This vulnerability (CVE-2026-21655) is classified as CWE-502: Deserialization of Untrusted Data. It affects Johnson Control's victor product on Windows, CCure 9000, and Victor Application Server. Versions affected include victor before 8.0, CCure 9000 before 3.2, and Victor Application Server before 4.1. The flaw allows attackers to exploit unsafe deserialization mechanisms, which can lead to high impact compromises. The CVSS 4.0 vector indicates the attack can be performed remotely without privileges or user interaction, with high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are currently available, and the remediation level is unspecified.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or cause denial of service by exploiting unsafe deserialization of untrusted data. The CVSS score of 8.7 reflects high impact on confidentiality, integrity, and availability. The attack vector is adjacent network, requiring no privileges or user interaction, making it a serious threat to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or mitigation has been published by Johnson Control at this time. Users should monitor vendor communications for updates and consider restricting network access to affected services as a precaution.