# CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD Unauthenticated Arbitrary Code Execution via Local File Inclusion / Relative Path Traversal

> An unauthenticated network attacker can abuse a local file inclusion / relative path traversal flaw (CWE-23) in the web application of Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 through 11) to execute arbitrary code and fully compromise the device. The affected versions are end-of-support; the fix is upgrading to Quantum HD Unity 12 or higher.

- **Published:** 2026-10-15T01:11:00Z
- **Last reviewed:** 2026-10-15T01:11:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3572
- **ID:** TL-2026-3572
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21659

## Description

CVE-2026-21659 was reported by Noam Moshe of Claroty Team82 and published via CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) and NVD (2026-02-27). The CVE description states that Unauthenticated Remote Code Execution and Information Disclosure due to a Local File Inclusion (LFI) vulnerability in Frick Controls Quantum HD allows an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. CISA classifies the weakness as CWE-23 (Relative Path Traversal); NVD additionally lists CWE-22. Third-party analysis (Burns & McDonnell) describes it as letting an unauthenticated remote attacker access files or execute code outside the intended directory scope of the device's web application, requiring only network reachability, and as an additional pre-authentication code-execution path that can be used alone or chained with the injection flaws in the same advisory.

The flaw is one of six vulnerabilities in the same CISA advisory: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (code injection / input validation, 9.1 each), CVE-2026-21659 (7.5) and CVE-2026-21660 (hardcoded credentials, CWE-256, 6.2). The advisory lists the affected version as 10.22 and earlier; the Claroty disclosure lists 10.22 through 11, both described as legacy platforms at end of support. Frick Controls Quantum HD is an industrial refrigeration controller; CISA lists Food and Agriculture as the affected sector.

Scoring differs by source. The CISA/CNA score is CVSS 7.5 (High); the CVSS v4.0 score is 8.7 (vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/...), which indicates a confidentiality-only base impact. The NVD record also shows a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The cvss_vector stored here, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, is quoted verbatim from the CISA advisory ICSA-26-057-01 (v3.1 score 7.5). CISA reported no known public exploitation at publication, and Aviatrix noted no public exploit as of 2026-02-27. The CISA SSVC assessment shows exploitation as feasible, automatable: yes, technical impact: total. No PoC code, exploit mechanics (parameter, endpoint or port), network IOCs or malware were found in any source, so IOCs below are product, version and advisory indicators rather than infrastructure.

Remediation per Johnson Controls: upgrade to Quantum HD Unity version 12 or higher, then verify compliance with the hardening guide and apply all recommended security configurations (Product Security Advisory JCI-PSA-2026-05). CISA recommends minimizing control-system internet exposure, isolating networks behind firewalls, and using VPNs for remote access.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T0819 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1005 Data from Local System
- T1078.001 Default Accounts

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21659](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-21659)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD - CVE-2026-21659](https://nvd.nist.gov/vuln/detail/CVE-2026-21659)
- [Johnson Controls Product Security Advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution](https://aviatrix.ai/threat-research-center/johnson-controls-2026-unauthenticated-remote-code-execution/)
- [Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [Mondoo Vulnerability Intelligence - CVE-2026-21659](https://mondoo.com/vulnerability-intelligence/vulnerability/CVE-2026-21659)
- [vuln.today - CVE-2026-21659](https://vuln.today/cve/CVE-2026-21659)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3572