This vulnerability (CVE-2026-34496) in Johnson Controls victor Web on Windows is categorized under CWE-269, indicating improper privilege management. It affects all versions prior to 7.1. The CVSS 4.0 base score is 7.1, reflecting a high severity with network attack vector, high complexity, and partial privileges required. The vulnerability allows an attacker with high privileges to perform a partial impact attack without user interaction. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with high privileges on the system could exploit this vulnerability to perform unauthorized actions due to improper privilege management. The impact is limited by the requirement for high privileges and partial impact on confidentiality, integrity, and availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected software to trusted administrators only and monitor for unusual activity consistent with privilege misuse.