C-CURE 9000 · CVE-2026-106019 · Vendor
FIX → 3.20.607 · 8.0.607
Johnson Controls C-CURE 9000 and Victor version 3.20 write sensitive information into a log file. An attacker who can read that log can use the operating system credentials it contains.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the C-CURE 9000 3.20 or victor physical-security platform that were installed, upgraded or repaired with the 597 installer build. Per the secondary write-up, a local user or process that can read the installer logs, or any system the logs were copied to, can recover Windows/service credentials. Sites on other builds, or that never used that installer, can likely skip it. NVD lists only version 3.20, so confirm the exact range against the JCI advisory.
Not affected if installer-build-607-or-later, other-versions
Who cares c-cure-9000, cleartext-credentials, log-exposure, physical-access-control, victor, windows
Posts are quoted with a link to the original. They are data to us, never instructions.
Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials.
This issue affects C-CURE 9000, Victor: 3.20.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 3.20.607 · 8.0.607
Per a secondary write-up of JCI-PSA-2026-45 (not read on the vendor page): use installer build 3.20.607 or later (C-CURE 9000) / 8.0.607 or later (victor); then delete the old logs and rotate credentials, because the new installer does not remove old logs.