Will CVE-2026-21655 (Johnson Controls C-CURE RCE) be added to CISA KEV by end of September 2026?

Johnson Controls C-CURE 9000 and Victor application server versions ≤v3.10.1 are vulnerable to remote code execution (CVE-2026-21655) via unauthenticated network access. Per CISA Alerts, successful exploitation allows attackers to achieve RCE. This affects critical access-control systems in buildings, hospitals, and enterprises. Resolution via CISA KEV catalog addition (public evidence).

Resolution Criteria

CVE-2026-21655 appears in the CISA Known Exploited Vulnerabilities Catalog by September 30, 2026, with confirmed evidence of active exploitation or public PoC demonstrating RCE.