{"affected":[{"defaultStatus":"unaffected","product":"C-CURE 9000, Victor","source":"CNA: jci","vendor":"Johnson Controls","versions":[{"status":"affected","version":"3.20"}]}],"cveId":"CVE-2026-106019","cwes":["CWE-532"],"description":"Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials.\n\nThis issue affects C-CURE 9000, Victor: 3.20.","epss":{"date":"2026-11-10","percentile":0.06318,"score":0.00169},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: jci","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L","version":"4.0"},{"score":8.8,"severity":"high","source":"NVD: productsecurity@jci.com","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794365867750,"publishedAt":1793974896622,"references":[{"source":"CNA: jci","tags":[],"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"},{"source":"productsecurity@jci.com","tags":[],"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}],"remediation":[],"revision":"aa9d26c5594655be43a8c2e40410b6aa273cbb1f975a37e97fe604feac06eb39","sources":[{"modifiedAt":1794365867750,"name":"CNA: jci","retrievedAt":1794366498273,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106019"},{"modifiedAt":1793999654733,"name":"NVD","retrievedAt":1794011164010,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106019"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794366531184,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106019"}],"ssvc":{"assessedAt":1794365858441,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2026-106019","updatedAt":1794366531184}