Threat reportVulnerabilityTL-2026-3572
CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD Unauthenticated Arbitrary Code Execution via Local File Inclusion / Relative Path Traversal
CVE-2026-21659 (TL-2026-3572), also tracked as JCI-PSA-2026-05, is a high-severity software vulnerability scored CVSS 7.5, first published 2026-10-15. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21659), maps to 5 MITRE ATT&CK techniques (T0819, T1005, T1059), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 7.5/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3572
- Threat ID
- TL-2026-3572
- Also known as
- JCI-PSA-2026-05, ICSA-26-057-01
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food-and-agriculture, industrial-refrigeration, manufacturing, cold-storage
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
How CVE-2026-21659 works
An unauthenticated network attacker can abuse a local file inclusion / relative path traversal flaw (CWE-23) in the web application of Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 through 11) to execute arbitrary code and fully compromise the device. The affected versions are end-of-support; the fix is upgrading to Quantum HD Unity 12 or higher.
CVE-2026-21659 was reported by Noam Moshe of Claroty Team82 and published via CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) and NVD (2026-02-27). The CVE description states that Unauthenticated Remote Code Execution and Information Disclosure due to a Local File Inclusion (LFI) vulnerability in Frick Controls Quantum HD allows an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. CISA classifies the weakness as CWE-23 (Relative Path Traversal); NVD additionally lists CWE-22. Third-party analysis (Burns & McDonnell) describes it as letting an unauthenticated remote attacker access files or execute code outside the intended directory scope of the device's web application, requiring only network reachability, and as an additional pre-authentication code-execution path that can be used alone or chained with the injection flaws in the same advisory.
The flaw is one of six vulnerabilities in the same CISA advisory: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (code injection / input validation, 9.1 each), CVE-2026-21659 (7.5) and CVE-2026-21660 (hardcoded credentials, CWE-256, 6.2). The advisory lists the affected version as 10.22 and earlier; the Claroty disclosure lists 10.22 through 11, both described as legacy platforms at end of support. Frick Controls Quantum HD is an industrial refrigeration controller; CISA lists Food and Agriculture as the affected sector.
Scoring differs by source. The CISA/CNA score is CVSS 7.5 (High); the CVSS v4.0 score is 8.7 (vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/...), which indicates a confidentiality-only base impact. The NVD record also shows a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The cvss_vector stored here, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, is quoted verbatim from the CISA advisory ICSA-26-057-01 (v3.1 score 7.5). CISA reported no known public exploitation at publication, and Aviatrix noted no public exploit as of 2026-02-27. The CISA SSVC assessment shows exploitation as feasible, automatable: yes, technical impact: total. No PoC code, exploit mechanics (parameter, endpoint or port), network IOCs or malware were found in any source, so IOCs below are product, version and advisory indicators rather than infrastructure.
Remediation per Johnson Controls: upgrade to Quantum HD Unity version 12 or higher, then verify compliance with the hardening guide and apply all recommended security configurations (Product Security Advisory JCI-PSA-2026-05). CISA recommends minimizing control-system internet exposure, isolating networks behind firewalls, and using VPNs for remote access.
MITRE ATT&CK techniques used in TL-2026-3572
Initial Access
T0819 Exploit Public-Facing Application; T1078.001 Default Accounts; T1190 Exploit Public-Facing Application
Collection
Execution
Affected products and versions in CVE-2026-21659
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 and earlier; 10.22 through 11
Fixed in: Quantum HD Unity 12 or higher
Remediation for CVE-2026-21659
Patches
- Quantum HD Unity version 12 and later (see Johnson Controls Product Security Advisory JCI-PSA-2026-05)
Immediate actions
- Upgrade Quantum HD controllers to Quantum HD Unity version 12 or higher using the vendor update procedure
- Remove Quantum HD web interfaces from internet exposure and restrict reachability to trusted management hosts
- Place control system devices behind firewalls, isolated from the business network
Workarounds
- Where upgrade is not immediately possible, block untrusted network access to the device web application
- Monitor HTTP requests to the device for relative path traversal sequences
Longer-term hardening
- After upgrading, verify full compliance with the Johnson Controls hardening guide and apply all recommended security configurations
- Use VPNs for required remote access to control system devices
- Apply zero trust segmentation and egress controls around industrial refrigeration controllers
- Plan replacement of end-of-support Quantum HD 10.22-11 platforms
CVEs associated with CVE-2026-21659
Weaknesses (CWE) in CVE-2026-21659
Timeline of CVE-2026-21659
- CISA advisory recommends minimizing network exposure, isolating control systems behind firewalls, using VPNs for remote access, and verifying hardening-guide compliance after upgrade.
- Johnson Controls directs customers to Quantum HD Unity version 12 or higher (JCI-PSA-2026-05, Quantum HD Unity Software Update Procedure) as the remediation; affected 10.22-11 platforms are legacy and end-of-support.
- CISA releases ICS Advisory ICSA-26-057-01 covering six Frick Controls Quantum HD vulnerabilities including CVE-2026-21659 (CVSS 7.5, CWE-23); no known public exploitation reported.
- Aviatrix reports no public exploit released for CVE-2026-21659 as of this date.
- Claroty Team82 (researcher Noam Moshe) lists CVE-2026-21659 on its disclosure dashboard: affected versions 10.22 through 11, fix is Quantum HD Unity 12 or higher.
- CVE-2026-21659 is published in NVD describing unauthenticated RCE and information disclosure via local file inclusion in Quantum HD.
- Burns & McDonnell 1898 Advisories publishes analysis of the pre-authentication Quantum HD vulnerabilities, noting CVE-2026-21659 as an additional pre-auth code execution path chainable with injection flaws.
Sources cited for CVE-2026-21659
- Claroty Team82 Disclosure Dashboard - CVE-2026-21659
- CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD
- NVD - CVE-2026-21659
- Johnson Controls Product Security Advisories
- Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution
- Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD
- Mondoo Vulnerability Intelligence - CVE-2026-21659
- vuln.today - CVE-2026-21659
Detection coverage for TL-2026-3572
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3572 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.