{"id":"CVE-2026-106019","kind":"vulnerability","aliases":["CVE-2026-106019"],"related":[],"title":"Johnson Controls C-CURE 9000 and Victor log file exposes operating system credentials","description":"Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials.\n\nThis issue affects C-CURE 9000, Victor: 3.20.","summary":"Johnson Controls C-CURE 9000 and Victor version 3.20 write sensitive information into a log file. An attacker who can read that log can use the operating system credentials it contains.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"C-CURE 9000","fixed":["3.20.607"],"affected":"3.20 (installer build 3.20.597)","ecosystem":"vendor"},{"name":"victor","fixed":["8.0.607"],"affected":"8.0 installer build 8.0.597 (NVD lists 3.20)","ecosystem":"vendor"}],"ecosystems":[],"tags":["c-cure-9000","cleartext-credentials","log-exposure","physical-access-control","vendor","victor","windows"],"not_affected_if":["installer-build-607-or-later","other-versions"],"how_to_check":"- Find out whether C-CURE 9000 3.20 or victor 8.0 was installed, upgraded or repaired from installer build 3.20.597 / 8.0.597 (offered for download July 1 to Sept 18, 2026, per Breachroad citing JCI). Check deployment history and package hashes.\n- Look in C:\\ProgramData\\JCI\\InstallerTemp\\ for installer logs such as UnifiedInstallDashboard.log, VictorApplicationServer_*.log, UnifiedServer_*.log and check them for cleartext credentials.\n- Also check whether those logs were copied to a SIEM, support ticket, backup or integrator share.","fix":"Per a secondary write-up of JCI-PSA-2026-45 (not read on the vendor page): use installer build 3.20.607 or later (C-CURE 9000) / 8.0.607 or later (victor); then delete the old logs and rotate credentials, because the new installer does not remove old logs.","status":"open","published_at":"2026-11-06T15:17:05+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:02+00:00","updated_at":"2026-11-06T15:46:43+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-06T15:44:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Johnson Controls C-CURE 9000 and Victor log file exposes operating system credentials","impact":"high","summary":"Johnson Controls C-CURE 9000 and Victor version 3.20 write sensitive information into a log file. An attacker who can read that log can use the operating system credentials it contains.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["c-cure-9000","victor","physical-access-control","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"operating system credentials readable from log files, enabling system takeover","analyst_note":"Find the vendor advisory from Johnson Controls to confirm the affected log, required access, and any fixed version.","how_to_check":"- Confirm whether the installed product is C-CURE 9000 or Victor version `3.20`\n- Review the product's log files for stored operating system credentials (the sources do not name the file location)","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"The description names C-CURE 9000 and Victor version 3.20 only. Sites running that version of the physical access control software are the ones to look at. The sources do not describe the exact log location or the configuration that triggers the logging.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4209,"output_tokens":489,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory from Johnson Controls to confirm the affected log, required access, and any fixed version.","search":"'-106019':17A,20A '-2026':16A,19A '3.20':52B,106C '9000':6A,24A,29B,48B,89C,104C 'access':38B 'affect':100C 'allow':91C 'attack':61B 'c':4A,22A,27B,46B,87C,102C 'c-cure':3A,21A,26B,45B,86C,101C 'cleartext':31B 'cleartext-credenti':30B 'contain':74B 'control':2A,39B,44B,85C 'credenti':14A,32B,72B,97C 'cure':5A,23A,28B,47B,88C,103C 'cve':15A,18A 'expos':11A 'exposur':35B 'file':10A,59B,81C 'inform':55B,78C 'insert':75C 'issu':99C 'johnson':1A,43B,84C 'known':94C 'log':9A,34B,58B,66B,80C 'log-exposur':33B 'oper':12A,70B,95C 'physic':37B 'physical-access-control':36B 'read':64B 'sensit':54B,77C 'system':13A,71B,96C 'use':68B,92C 'vendor':40B 'version':51B 'victor':8A,25A,41B,50B,90C,105C 'vulner':82C 'window':42B 'write':53B","nicknames":[],"mitigations":[],"who_affected":"Sites running the C-CURE 9000 3.20 or victor physical-security platform that were installed, upgraded or repaired with the 597 installer build. Per the secondary write-up, a local user or process that can read the installer logs, or any system the logs were copied to, can recover Windows/service credentials. Sites on other builds, or that never used that installer, can likely skip it. NVD lists only version 3.20, so confirm the exact range against the JCI advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["9000","ccure9000","victor"],"ptokens":["9000","cure","victor"],"labels":["ccure9000","cleartextcredentials","high","logexposure","physicalaccesscontrol","vendor","victor","windows"],"campaign_type":null,"search_a":"'-106019':17A,20A '-2026':16A,19A '9000':6A,24A 'c':4A,22A 'c-cure':3A,21A 'control':2A 'credenti':14A 'cure':5A,23A 'cve':15A,18A 'expos':11A 'file':10A 'johnson':1A 'log':9A 'oper':12A 'system':13A 'victor':8A,25A","search_b":"'3.20':52B '9000':29B,48B 'access':38B 'attack':61B 'c':27B,46B 'c-cure':26B,45B 'cleartext':31B 'cleartext-credenti':30B 'contain':74B 'control':39B,44B 'credenti':32B,72B 'cure':28B,47B 'exposur':35B 'file':59B 'inform':55B 'johnson':43B 'log':34B,58B,66B 'log-exposur':33B 'oper':70B 'physic':37B 'physical-access-control':36B 'read':64B 'sensit':54B 'system':71B 'use':68B 'vendor':40B 'version':51B 'victor':41B,50B 'window':42B 'write':53B","search_c":"'3.20':106C '9000':89C,104C 'affect':100C 'allow':91C 'c':87C,102C 'c-cure':86C,101C 'control':85C 'credenti':97C 'cure':88C,103C 'file':81C 'inform':78C 'insert':75C 'issu':99C 'johnson':84C 'known':94C 'log':80C 'oper':95C 'sensit':77C 'system':96C 'use':92C 'victor':90C,105C 'vulner':82C","first_public_at":"2026-11-06T15:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productsecurity@jci.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106019","severity":null,"published_at":"2026-11-06T15:17:05+00:00","modified_at":"2026-11-06T15:17:05+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106019:1907","url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","severity":null,"published_at":"2026-11-06T15:46:43+00:00","modified_at":"2026-11-06T15:46:43+00:00","first_seen_at":"2026-11-06T15:46:43+00:00","fetched_at":"2026-11-06T15:46:43+00:00","note":"Vendor advisory JCI-PSA-2026-45 (Nov 5 2026) confirmed on JCI's advisory index, but the PDF could not be fetched (guessed URLs returned the home page). Build numbers, fix, log paths come from Breachroad's write-up citing the advisory; nothing marked verified. NVD says 'C-CURE 9000, Victor: 3.20'; Breachroad says victor 8.0 - discrepancy unresolved. Settle by reading the PSA PDF.","cites":["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","https://breachroad.com/en/blog/ccure-9000-victor-cve-2026-106019-credentials-in-logs/"]}],"documents":[{"id":54501,"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","title":"Johnson Controls Product Security Advisories (lists JCI-PSA-2026-45, CVE-2026-106019)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":87616,"url":"https://breachroad.com/en/blog/ccure-9000-victor-cve-2026-106019-credentials-in-logs/","title":"Breachroad: C•CURE 9000 and victor CVE-2026-106019 exposed credentials in logs (secondary, cites JCI-PSA-2026-45)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}