# Johnson Controls C-CURE 9000 RCE flaw disclosed

Published: 2026-07-23 · Severity: high · Sectors: manufacturing
Canonical: https://vorant.io/reports/533b85e3-2dd7-50ab-aaac-c078bf10c1ea/johnson-controls-c-cure-9000-rce-flaw-disclosed

> Deserialization, SSRF, and access-control flaws in Johnson Controls C-CURE 9000/victor physical security servers could let attackers gain remote code execution or leak sensitive data.

CISA has published an advisory for three vulnerabilities affecting Johnson Controls' C-CURE 9000 and victor application server, a physical access control and video management platform used worldwide in critical manufacturing environments. The most severe issue, CVE-2026-21655, is a .NET deserialization vulnerability reachable by an unauthenticated attacker on the adjacent network, allowing arbitrary code execution on the application server and connected clients such as physical security workstations. Two additional flaws affect victor Web: an SSRF vulnerability (CVE-2026-21653) that could allow forged internal HTTP requests leading to information disclosure or lateral movement, and a broken access control issue (CVE-2026-34496) that could let low-privilege users view sensitive user and audit log data.

All three vulnerabilities stem from design issues in versions up to C-CURE 9000/victor v2.90_v3.0 and victor Web v7.1. Johnson Controls has released fixed versions (3.20 for the application server, 7.0 for victor Web) and recommends network segmentation, restricting port 8999 access, IDS/IPS signatures for .NET deserialization payloads (e.g., ysoserial.net patterns), application whitelisting, and monitoring for anomalous SoftwareHouse.CrossFire.Server.exe process activity. The vulnerabilities were responsibly disclosed by researcher Harrison Neal, and CISA states no known public exploitation has been reported at this time.

Given the products' role in physical security controls for critical manufacturing facilities globally, successful exploitation of the deserialization flaw in particular could have real-world safety and access-control implications, though the lack of observed in-the-wild exploitation and requirement for adjacent network access moderates urgency for organizations that have not yet patched.

## Mentioned in this report

- Vulnerabilities: CVE-2026-21653, CVE-2026-21655, CVE-2026-34496

## Detection guidance (public sample)

### Suspicious Child Process Spawned by C-CURE 9000 Application Server Process

ATT&CK: T1059

Detects command/script interpreters or scripting engines spawned by SoftwareHouse.CrossFire.Server.exe, the C-CURE 9000/victor application server process - consistent with exploitation of the CVE-2026-21655 .NET deserialization RCE leading to arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by C-CURE 9000 Application Server Process
description: The C-CURE 9000/victor application server process (SoftwareHouse.CrossFire.Server.exe)
  does not normally spawn command interpreters or scripting hosts. A .NET deserialization
  vulnerability (CVE-2026-21655) allows an unauthenticated attacker on the adjacent
  network to achieve arbitrary code execution through this process, which would typically
  manifest as an unexpected child process such as cmd.exe, powershell.exe, wscript.exe,
  or mshta.exe.
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \SoftwareHouse.CrossFire.Server.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \powershell_ise.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
  condition: selection
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks explicitly configured
  to be launched by the application server service account
- Third-party integration or backup agents that hook into the C-CURE service process
level: high
id: a225b69c-539e-59fe-a814-1137b58d3797
status: experimental
author: Vorant
```

### Encoded or Obfuscated PowerShell Execution From C-CURE Application Server Process

ATT&CK: T1059.001

Detects PowerShell invoked with encoded/obfuscated command-line flags by the C-CURE 9000/victor application server process, indicative of post-exploitation payload execution following deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Encoded or Obfuscated PowerShell Execution From C-CURE Application Server Process
description: Detects PowerShell launched with encoded-command or download-and-execute
  style flags where the parent process is the C-CURE 9000/victor application server
  (SoftwareHouse.CrossFire.Server.exe). This pattern is consistent with a deserialization
  gadget chain (e.g., ysoserial.net-style payloads) dropping and executing a PowerShell
  stage after exploiting CVE-2026-21655.
tags:
- attack.execution
- attack.t1059.001
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \SoftwareHouse.CrossFire.Server.exe
    Image|endswith: \powershell.exe
  encoded_flags:
    CommandLine|contains:
    - -enc
    - -EncodedCommand
    - FromBase64String
    - -nop
    - -w hidden
    - -WindowStyle Hidden
    - IEX
    - Invoke-Expression
  condition: selection and encoded_flags
falsepositives:
- Custom monitoring or automation scripts intentionally invoked with hidden windows
  by the application server service
level: high
id: e859a448-df28-55b5-bc8c-d3c1e0baddaa
status: experimental
author: Vorant
```

### C-CURE 9000 Application Server Process Initiating Outbound Network Connection

ATT&CK: T1190

Flags the C-CURE 9000/victor application server process establishing outbound network connections it does not normally initiate, potentially indicating post-exploitation C2 or lateral movement after RCE via CVE-2026-21655. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: C-CURE 9000 Application Server Process Initiating Outbound Network Connection
description: SoftwareHouse.CrossFire.Server.exe is the C-CURE 9000/victor application
  server process; it normally accepts inbound connections from clients/panels rather
  than initiating outbound connections to arbitrary hosts. Successful exploitation
  of the .NET deserialization vulnerability (CVE-2026-21655) or SSRF flaw (CVE-2026-21653)
  could cause this process to reach out to attacker-controlled or internal-only infrastructure.
  Combine with host allow-listing of expected panel/client subnets to reduce noise.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \SoftwareHouse.CrossFire.Server.exe
    Initiated: true
  filter_known_mgmt_ports:
    DestinationPort:
    - 443
    - 8999
  condition: selection and not filter_known_mgmt_ports
falsepositives:
- Legitimate outbound calls to licensing, update, or cloud video services configured
  for the platform
- Health-check or monitoring integrations that poll external endpoints from the application
  server host
level: medium
id: 8218f4a7-cd9f-55eb-8658-d5917b0e6e50
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/533b85e3-2dd7-50ab-aaac-c078bf10c1ea/johnson-controls-c-cure-9000-rce-flaw-disclosed.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup