CVE-2026-21653

A Server Side Request Forgery (SSRF) vulnerability exists in Johnson Controls' CCure 9000 and Victor application server, impacting versions 2.9 through 3.0. This flaw could allow an attacker to manipulate server requests, potentially leading to unauthorized access to internal resources. Organizations using these affected versions should prioritize remediation to mitigate the risk of exploitation.