Will Johnson Controls C-CURE RCE vulnerability be actively exploited before Sept 2026?

CISA has disclosed remote code execution vulnerabilities in Johnson Controls C-CURE 9000 and Victor application server (≤v2.90_v3.0 and ≤v7.1). These systems manage physical access control and are widely deployed in critical infrastructure.

Resolution Criteria

CISA KEV addition; vendor confirmation of in-the-wild exploitation; or public disclosure by Mandiant, CrowdStrike, or CISA alert of active RCE exploitation campaigns by Sept 30, 2026.