Will Johnson Controls C-CURE RCE vulnerability be actively exploited before Sept 2026?
[Auto-closed — deadline passed with no qualifying event] The market deadline was 2026-10-01. Today is 2026-10-03 (past deadline). No credible evidence of CISA KEV addition, vendor confirmation, or public disclosure of active RCE exploitation of Johnson Controls C-CURE vulnerabilities has appeared. The deadline has passed with no qualifying event.
Evidence: https://threatodds.com/markets/4cb9395d-448e-4803-99c0-dda510fbc778Market Overview
AI GENERATEDCISA has disclosed remote code execution vulnerabilities in Johnson Controls C-CURE 9000 and Victor application server (≤v2.90_v3.0 and ≤v7.1). These systems manage physical access control and are widely deployed in critical infrastructure.
Primary SourceResolution Criteria
CISA KEV addition; vendor confirmation of in-the-wild exploitation; or public disclosure by Mandiant, CrowdStrike, or CISA alert of active RCE exploitation campaigns by Sept 30, 2026.