CISA published ICSA-26-204-01 on August 11, 2026, disclosing a critical remote code execution vulnerability in Johnson Controls’ C·CURE 9000 access control and security management system. The flaw, CVE-2026-21655, carries a CVSS 3.1 base score of 9.8 — unauthenticated, network-accessible, low complexity. The affected product is deployed in airports, government facilities, hospitals, data centres, financial institutions, and corporate campuses worldwide.
The advisory marks a significant disclosure because C·CURE 9000 sits at the boundary between physical security infrastructure and IT/OT networks. Compromise of a physical access control system in an enterprise or critical infrastructure environment enables physical boundary crossings that can precede or facilitate cyber intrusions into OT environments.
Vulnerability Details: CVE-2026-21655
Affected product: Johnson Controls C·CURE 9000 Physical Access and Security Management System
Affected versions: All versions prior to 3.0.3
CVSS 3.1 Base Score: 9.8 (Critical)
Attack Vector: Network
Authentication Required: None
Complexity: Low
Impact: Full remote code execution on the C·CURE 9000 Application Server
CVE-2026-21655 is a deserialization vulnerability in the C·CURE 9000 server’s communication handler. The server accepts serialised objects from clients over the network as part of its normal operating protocol. The deserialisation process does not validate object types or sanitise the input before processing, which allows an attacker to submit a crafted serialised payload that executes arbitrary code in the context of the server process.
The server process typically runs with elevated system privileges on a Windows host — meaning code execution achieves SYSTEM-level access on the C·CURE 9000 application server. From that position, an attacker can:
- Read and modify the access control database (employee credentials, badge data, access levels, site floor plans)
- Unlock or lock physical access points controlled by the system (doors, turnstiles, barriers, elevator access)
- Create new access credentials that grant physical access to controlled areas
- Pivot to other systems on the physical security network (door controllers, cameras, intercom systems)
- Access the Windows host file system and network for further lateral movement into adjacent IT networks
The service port used by the vulnerable handler varies by installation but is typically within the default C·CURE 9000 communication port range. Deployments that expose this port to untrusted network segments without firewall controls are directly exploitable.
Exploitation Risk in OT-Adjacent Deployments
C·CURE 9000 is frequently deployed in environments where physical and operational technology security converge. Manufacturing facilities, utilities, and energy sector operations use physical access control to restrict entry to server rooms, control rooms, and substations containing OT equipment.
In these deployments, the C·CURE 9000 server is often on the corporate IT network with connectivity to the OT network for badge-reader controllers located near physical OT assets. This creates an indirect path from the internet (via CVE-2026-21655 compromise of the PACS server) through the corporate network into the OT environment — or at minimum a path to physical access to OT assets by manipulating badge access controls.
The risk is not theoretical: a state-sponsored actor targeting an energy facility or manufacturing plant that wants physical access to a substation control room or PLC cabinet can use a PACS compromise to grant that access without triggering typical intrusion detection. Physical access bypasses many IT/OT security controls entirely.
Affected Version Identification
Johnson Controls has released version 3.0.3 as the fixed release. To identify the installed version:
- Log in to the C·CURE 9000 Administration workstation
- Navigate to Help > About C·CURE 9000
- The version number is displayed in the system information dialog
Alternatively, the installed version can be queried from the Windows Registry on the application server:
HKLM\SOFTWARE\Software House\CrossFire Server\VersionAny version string below 3.0.3.xxxxx is affected.
Recommended Mitigations
Immediate: Network Isolation
Restrict network access to the C·CURE 9000 Application Server port. Until the patch is applied, the most effective mitigation is firewall rules that limit which hosts can communicate with the C·CURE 9000 server’s service port. Only C·CURE 9000 workstations, door controllers, and administrative hosts that require server communication should be able to reach this port.
If the C·CURE 9000 server is internet-accessible, revoke that access immediately. Physical access control servers should never be directly reachable from the internet.
Segment the physical security network from general corporate IT. The C·CURE 9000 server and its associated door controller network should be on a dedicated VLAN with firewall rules restricting access. Lateral movement from this network to corporate IT (and vice versa) should require passing through a firewall that blocks all unnecessary protocols.
Patch: Apply Version 3.0.3
Johnson Controls released version 3.0.3 to address CVE-2026-21655. The update is available through the Johnson Controls Software House support portal. Apply the update on the C·CURE 9000 Application Server. Door controllers and client workstations may require separate update packages — refer to the Johnson Controls version 3.0.3 release notes for full patch scope.
Test in a non-production environment first if one is available. C·CURE 9000 updates have historically required service restarts that interrupt badge reader operations temporarily. Schedule the update during a maintenance window with physical security staff aware of the temporary access impact.
Post-Patch: Access Audit
After applying the patch, conduct an audit of recent access control events and administrator activity:
- Review administrator account last-login timestamps — unexpected recent logins may indicate exploitation
- Audit access level changes made in the past 30 days for unrecognised entries
- Check for new badge credentials created with elevated or all-access permissions
- Review physical access logs for door-unlock events occurring outside business hours or in unusual patterns
- Examine the C·CURE 9000 application server’s Windows Event Log for unusual service account activity or process creation events
Longer-Term: Network Monitoring
Deploy network monitoring on the physical security VLAN to detect anomalous communication patterns. C·CURE 9000 servers have deterministic communication patterns — they talk to door controllers, workstations, and defined administrative hosts. Traffic to unexpected destinations, or unusual inbound connection attempts to the service port, are detectable signals of compromise or active scanning.
CISA’s ICSA-26-204-01 advisory notes that Johnson Controls is not aware of active exploitation of CVE-2026-21655 as of the publication date. However, the combination of a 9.8 CVSS score, unauthenticated attack vector, and common deployment in critical infrastructure environments makes this a high-priority patch for any organisation running C·CURE 9000.
Summary
| Item | Detail |
|---|---|
| CVE | CVE-2026-21655 |
| CISA Advisory | ICSA-26-204-01 |
| CVSS Score | 9.8 (Critical) |
| Affected Versions | C·CURE 9000 < 3.0.3 |
| Fix Available | Version 3.0.3 |
| Authentication Required | No |
| Attack Vector | Network |
| Primary Risk | RCE → PACS database access, physical boundary manipulation, lateral movement |
Apply the patch. Restrict network access to the server as an interim control. Audit for signs of prior exploitation given the severity of the flaw.