The vulnerability identified as CVE-2026-21655 involves deserialization of untrusted data in Johnson Control victor software on Windows platforms. It affects versions starting from 2.9 before 3.0. Deserialization flaws can allow attackers to manipulate serialized objects, potentially leading to arbitrary code execution or other severe impacts. The CVSS 4.0 vector indicates a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no official patch or remediation details are currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or cause denial of service by exploiting the deserialization process of untrusted data. The CVSS 4.0 score indicates high impact on confidentiality, integrity, and availability, meaning sensitive information could be disclosed, altered, or systems could be disrupted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected software and applying any available workarounds recommended by the vendor.