C•CURE 9000 and victor CVE-2026-106019 exposed credentials in logs
C•CURE 9000 and victor installers wrote authentication data in cleartext. Check affected builds, remove exposed logs and rotate credentials.
- AUTHOR
- Karol Rapacz / CEO Breachroad · OSCP · PNPT
- PUBLISHED
- 6 November 2026
- READING TIME
- 9 min read
- TOPIC
- Identity and Access
Johnson Controls has disclosed CVE-2026-106019 in the C•CURE 9000 3.20 and victor 8.0 installers. During installation, upgrade or repair, the vulnerable installer could write authentication information to local log files in cleartext.
The issue affects specific 3.20.597 and 8.0.597 builds that were available for download between July 1 and September 18, 2026. Moving to a corrected installer does not remove logs already created or invalidate exposed passwords. A complete response must therefore combine the update with discovery, investigation and credential rotation.
The priority action: use installer build 3.20.607 or later, remove all local copies of the vulnerable package, identify servers installed or repaired with that build, securely delete the listed logs and rotate authentication data that may have appeared in them.
What CVE-2026-106019 exposes
C•CURE 9000 manages physical access control, visitors, badges and security events. victor brings video and security management into the same operational environment. Credentials used to deploy these platforms can hold broad privileges across databases, services and administration components.
Johnson Controls classifies the issue as CWE-532 — Insertion of Sensitive Information into Log File. A local user, low-privileged process or attacker with file-system access could read the leftover data. The vendor identifies another path as well: logs may have been copied automatically to central monitoring, support tooling or backups, increasing the investigation scope.
The vulnerability has a CVSS 4.0 score of 8.8 (High). Johnson Controls does not report confirmed active exploitation in the advisory. The high rating reflects possible exposure of administrative credentials and subsequent technical or operational impact.
Affected C•CURE 9000 and victor versions
| Product | Vulnerable installer | Fixed installer |
|---|---|---|
| C•CURE 9000 3.20 | build 3.20.597 | build 3.20.607 or later |
| victor 8.0 | build 8.0.597 | build 8.0.607 or later |
The vulnerable build was offered for a limited period, but the risk did not expire on September 18. Copies can remain in a deployment repository, administrator folder, software-distribution system or an integrator’s archive. A server installed during that period may also retain old logs.
Where to look for logs containing credentials
The vendor identifies C:\ProgramData\JCI\InstallerTemp\ and files including:
UnifiedInstallDashboard.log;CCurePortal_[TIMESTAMP].log;CCureWebClient_[TIMESTAMP].log;CCPortal_[TIMESTAMP].log;CrossFireWebService_[TIMESTAMP].log;VictorApplicationServer_[TIMESTAMP].log;vWSInstallerHelper.log;DBManager_Deploy_UNIFIEDSERVER-[TIMESTAMP].log;UnifiedServer_[TIMESTAMP].log.
Treat this as a starting point, not the complete boundary. Determine whether the files reached a SIEM, support ticket, diagnostic archive, backup or integrator share. Avoid copying suspected logs into additional locations without a clear need, as that can duplicate the secret.
Business response plan
1. Identify every use of build 597
Review deployment history, package hashes, software-distribution records and integrator documentation. Include installations, upgrades and repair actions from July 1 onwards. The currently running application version does not always reveal which installer was used in the past.
2. Replace the installer and prevent reuse
Obtain build 607 or later from an authorised source. Remove the vulnerable package from repositories, shares and recovery procedures. Confirm that automation does not reference an old path or cached copy.
3. Preserve evidence, then remove exposed logs
If abuse is suspected, coordinate evidence preservation with incident response first. Then delete the affected logs in line with the vendor advisory and the organisation’s retention rules. Merely moving a file to another directory does not remove the exposure.
4. Rotate every recoverable secret
Rotation should cover administrative accounts, databases, service accounts and other credentials supplied to the installer. Check whether any password was reused elsewhere. If the logs reached a central platform, review the accounts and people able to access that copy too.
5. Review file access and system activity
Johnson Controls recommends reviewing events, telemetry and activity involving C•CURE 9000 or victor before November 3, 2026. Examine file-access audit records for installer directories, reads by non-administrative accounts, log exports, new administrative sessions and unusual operations in the access-control system.
Why this spans physical and cybersecurity
An access-control platform is not an ordinary office application. It connects digital identity with doors, restricted areas, badges, video and security response. Administrative credential exposure can affect data, operational continuity and the integrity of physical-security records.
The response should not belong to IT alone. Include physical security, database administrators, the integrator, facility ownership, the SOC and business continuity stakeholders. A joint plan reduces the chance that a rushed password change unexpectedly breaks dependent services.
Larger environments should maintain a catalogue of service accounts and dependencies before an incident occurs. Our strong-password myths guide explains why uniqueness and controlled rotation matter more than cosmetic one-character changes.
Source facts and Breachroad conclusions
Johnson Controls confirms the vulnerable and fixed builds, availability window, cleartext authentication data, example log paths and the need to remove files and rotate credentials. The vendor does not report an active CVE-2026-106019 exploitation campaign.
Expanding the hunt to SIEM platforms, backups and ticketing systems, combining IT and physical-security response and sequencing safe rotation are Breachroad recommendations. Organisations can practise secrets handling and incident decisions through corporate cybersecurity training, while an IT security audit can assess permissions, log retention and service-account dependencies.
FAQ: CVE-2026-106019 in C•CURE 9000 and victor
Is installing fixed build 607 enough?
No. The new installer prevents future creation of the flawed logs, but it does not remove old files or change authentication data that was already exposed.
Who could read the credentials?
The vendor identifies a local user or process with access to the relevant files. Risk also extends to systems where the logs were copied or archived.
Is the vulnerability actively exploited?
The Johnson Controls advisory does not report confirmed active exploitation. Organisations should still review file access and rotate exposed secrets.
Must every password in the platform be changed?
Prioritise credentials supplied during installation, upgrade or repair with the vulnerable build and any secrets found in the logs. The final scope should follow evidence and service dependencies.
Primary sources: Johnson Controls — JCI-PSA-2026-45, Johnson Controls — security advisories, Johnson Controls — hardening resources.
