Threat reportICS/SCADATL-2026-3573
CVE-2026-21658 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation)
CVE-2026-21658 (TL-2026-3573), also tracked as JCI-PSA-2026-05, is a critical-severity ICS/SCADA threat scored CVSS 9.1, first published 2026-10-15. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21658), maps to 4 MITRE ATT&CK techniques (T1059, T1190, T1203), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3573
- Threat ID
- TL-2026-3573
- Also known as
- JCI-PSA-2026-05, ICSA-26-057-01
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- Status
- MONITORING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food and agriculture, industrial refrigeration, cold storage, critical manufacturing
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-21658 works
Insufficient validation of input in certain parameters of Johnson Controls Frick Controls Quantum HD (10.22 and earlier, tracked through version 11) permits unexpected actions, including code injection, before authentication. The affected versions are end-of-support legacy platforms; the vendor recommends upgrading to Quantum HD Unity 12 or higher.
CVE-2026-21658 is a pre-authentication code injection flaw (CWE-94, Improper Control of Generation of Code) in the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller. Certain input parameters are insufficiently validated, so a remote, unauthenticated attacker with network reachability to the controller interface can trigger unexpected actions; NVD describes the issue as unauthenticated remote code execution. Claroty Team82 (researcher Noam Moshe) discovered and reported it.
The flaw is one of six vulnerabilities disclosed together in CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) and Johnson Controls advisory JCI-PSA-2026-05: CVE-2026-21654 (OS command injection, CWE-78), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (code injection, CWE-94), CVE-2026-21659 (relative path traversal, CWE-23) and CVE-2026-21660 (plaintext password storage, CWE-256). CISA scores CVE-2026-21658 at CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the CNA CVSS v4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H with a base score of 8.8. Some aggregators report 9.8 with full confidentiality impact; the CISA vector is used here.
The affected releases (10.22 and earlier; Team82 lists 10.22 through 11) are legacy platforms that have reached end of support. Johnson Controls recommends upgrading to Quantum HD Unity version 12 or higher, then verifying compliance with the hardening guide and applying the security configuration. CISA reports no known public exploitation to it, and no public PoC, KEV listing or network IOCs are documented in the sources. The CISA advisory lists the Food and Agriculture sector, deployed worldwide. Because the flaw is pre-authentication, exposure of the controller network interface is the key risk factor; integrity and availability impact on refrigeration process control is high.
MITRE ATT&CK techniques used in TL-2026-3573
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in CVE-2026-21658
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 and earlier; 10.22 through 11
Fixed in: Quantum HD Unity 12 or higher
Remediation for CVE-2026-21658
Patches
- Upgrade to Frick Controls Quantum HD Unity version 12 or higher per Quantum_HD_Unity_Software_Update_Procedure.pdf (JCI-PSA-2026-05)
Immediate actions
- Remove Quantum HD controller interfaces from direct internet exposure and restrict network access to trusted management hosts only
- Place controllers behind firewalls and segment OT networks from business networks
- Monitor for unexpected network connections and anomalous requests to Quantum HD interfaces
Workarounds
- No patch exists for the legacy 10.22-11 platforms; rely on network isolation until upgrade
Longer-term hardening
- Plan migration off end-of-support Quantum HD 10.22 through 11 to Quantum HD Unity 12 or higher
- Verify compliance with the Quantum HD Unity hardening guide and apply the security configuration after upgrade
CVEs associated with CVE-2026-21658
Weaknesses (CWE) in CVE-2026-21658
Timeline of CVE-2026-21658
- CVE-2026-21658 reserved in the CVE program (CNA: Johnson Controls)
- CISA releases ICS Advisory ICSA-26-057-01; reports no known public exploitation; credits Noam Moshe of Claroty Team82
- Johnson Controls publishes advisory JCI-PSA-2026-05 for Frick Controls Quantum HD covering CVE-2026-21654, -21656, -21657, -21658, -21659 and -21660
- Claroty Team82 lists CVE-2026-21658 on its disclosure dashboard with CVSS 9.1 and affected versions 10.22 through 11
- CVE-2026-21658 published to CVE/NVD as an unauthenticated code injection (CWE-94) in Frick Controls Quantum HD 10.22 and earlier
- Third-party advisory aggregators (e.g. Rewterz) republish the Quantum HD vulnerability cluster for defenders
Sources cited for CVE-2026-21658
- Claroty Team82 Disclosure Dashboard - CVE-2026-21658
- CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD
- NVD - CVE-2026-21658
- Johnson Controls Product Security Advisory JCI-PSA-2026-05 (Frick Controls Quantum HD)
- Quantum HD Unity Software Update Procedure (vendor)
- Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD Industrial Refrigeration Controller
- INCIBE-CERT - Multiples vulnerabilidades en Frick Controls Quantum HD de Johnson Controls
- Rewterz Threat Advisory - ICS: Multiple Johnson Controls Frick Controls Quantum HD Vulnerabilities
- Lutra Security Field Guide - CVE-2026-21658
Detection coverage for TL-2026-3573
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3573 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.