---
id: "CVE-2026-106019"
page: "https://infrastack.ai/live/CVE-2026-106019"
kind: "vulnerability"
aliases: ["CVE-2026-106019"]
title: "Johnson Controls C-CURE 9000 and Victor log file exposes operating system credentials"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "C-CURE 9000", "fixed": ["3.20.607"], "affected": "3.20 (installer build 3.20.597)", "ecosystem": "vendor"}, {"name": "victor", "fixed": ["8.0.607"], "affected": "8.0 installer build 8.0.597 (NVD lists 3.20)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["c-cure-9000", "cleartext-credentials", "log-exposure", "physical-access-control", "vendor", "victor", "windows"]
not_affected_if: ["installer-build-607-or-later", "other-versions"]
published_at: "2026-11-06T15:17:05+00:00"
first_seen_at: "2026-11-06T15:42:43+00:00"
updated_at: "2026-11-06T15:46:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106019", "first_seen_at": "2026-11-06T15:42:43+00:00"}, {"source": "analyst", "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories", "first_seen_at": "2026-11-06T15:46:43+00:00", "cites": ["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories", "https://breachroad.com/en/blog/ccure-9000-victor-cve-2026-106019-credentials-in-logs/"]}]
exploit_sources: []
---

# Johnson Controls C-CURE 9000 and Victor log file exposes operating system credentials

Link for people: https://infrastack.ai/live/CVE-2026-106019 (this .md is for agents)

Johnson Controls C-CURE 9000 and Victor version 3.20 write sensitive information into a log file. An attacker who can read that log can use the operating system credentials it contains.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:C-CURE 9000 affected 3.20 (installer build 3.20.597) fixed 3.20.607
- vendor:victor affected 8.0 installer build 8.0.597 (NVD lists 3.20) fixed 8.0.607

## How to check

- Find out whether C-CURE 9000 3.20 or victor 8.0 was installed, upgraded or repaired from installer build 3.20.597 / 8.0.597 (offered for download July 1 to Sept 18, 2026, per Breachroad citing JCI). Check deployment history and package hashes.
- Look in C:\ProgramData\JCI\InstallerTemp\ for installer logs such as UnifiedInstallDashboard.log, VictorApplicationServer_*.log, UnifiedServer_*.log and check them for cleartext credentials.
- Also check whether those logs were copied to a SIEM, support ticket, backup or integrator share.

## Fix

Per a secondary write-up of JCI-PSA-2026-45 (not read on the vendor page): use installer build 3.20.607 or later (C-CURE 9000) / 8.0.607 or later (victor); then delete the old logs and rotate credentials, because the new installer does not remove old logs.

## Timeline

- 2026-11-06T15:42:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106019
- 2026-11-06T15:46:43+00:00 analyst https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories — Vendor advisory JCI-PSA-2026-45 (Nov 5 2026) confirmed on JCI's advisory index, but the PDF could not be fetched (guessed URLs returned the home page). Build numbers, fix, log paths come from Breachroad's write-up citing the advisory; nothing marked verified. NVD says 'C-CURE 9000, Victor: 3.20'; Breachroad says victor 8.0 - discrepancy unresolved. Settle by reading the PSA PDF.

## Documents

- [advisory] Johnson Controls Product Security Advisories (lists JCI-PSA-2026-45, CVE-2026-106019) https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
- [describes] Breachroad: C•CURE 9000 and victor CVE-2026-106019 exposed credentials in logs (secondary, cites JCI-PSA-2026-45) https://breachroad.com/en/blog/ccure-9000-victor-cve-2026-106019-credentials-in-logs/

## From the sources

Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials.

This issue affects C-CURE 9000, Victor: 3.20.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_