CVE-2026-21655 in victor
Summary
by MITRE • 07/24/2026
Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586.
This issue affects victor: from 2.9 before 3.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The deserialization of untrusted data vulnerability in Johnson Controls Victor on Windows represents a critical security flaw that enables remote code execution through the exploitation of insecure object deserialization practices. This vulnerability specifically impacts the Victor SCADA system version 2.9 and earlier, creating a pathway for attackers to execute arbitrary code on affected systems. The weakness stems from the application's failure to properly validate and sanitize input data during the deserialization process, allowing maliciously crafted serialized objects to be processed without adequate security controls.
This vulnerability directly maps to CWE-502 which describes "Deserialization of Untrusted Data" as a fundamental security flaw where applications deserialize data from untrusted sources without proper validation mechanisms. The attack vector aligns with CAPEC-586, which specifically addresses "Deserialize Object" attacks that leverage the deserialization process to inject malicious code into vulnerable applications. The Victor SCADA system's implementation fails to implement proper input sanitization and object validation during deserialization operations, creating an exploitable condition where attacker-controlled data can be transformed into executable code within the application context.
The operational impact of this vulnerability extends beyond simple remote code execution to encompass complete system compromise and potential industrial control system disruption. An attacker exploiting this vulnerability could gain unauthorized access to critical infrastructure control systems, potentially leading to operational technology (OT) environment compromise with severe consequences for industrial processes. The affected version range of 2.9 through the pre-3.0 release indicates a widespread exposure across multiple system deployments, particularly within environments where legacy SCADA systems remain operational without proper patching cycles.
Organizations should implement immediate mitigations including applying vendor-provided security patches to upgrade from Victor versions 2.9 and earlier to version 3.0 or later. Network segmentation and access controls should be enforced to limit exposure of affected systems to untrusted networks, while monitoring solutions should be deployed to detect potential exploitation attempts through anomalous deserialization activities. The remediation approach should also include disabling unnecessary deserialization capabilities where possible and implementing proper input validation mechanisms that align with the principle of least privilege. Security teams must consider this vulnerability within their broader threat modeling frameworks and ensure that industrial control system security policies address secure coding practices for serialization operations, referencing ATT&CK technique T1203 for exploitation of deserialization vulnerabilities in enterprise environments.