CVE-2026-106019

CVSS 8.8 (high) · published 2026-11-06

Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials. This issue affects C-CURE 9000, Victor: 3.20.

Weakness: CWE-532

Source: NVD CVE-2026-106019

References

• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.