# CVE-2026-21658 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation)

> Insufficient validation of input in certain parameters of Johnson Controls Frick Controls Quantum HD (10.22 and earlier, tracked through version 11) permits unexpected actions, including code injection, before authentication. The affected versions are end-of-support legacy platforms; the vendor recommends upgrading to Quantum HD Unity 12 or higher.

- **Published:** 2026-10-15T01:32:07Z
- **Last reviewed:** 2026-10-15T01:32:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3573
- **ID:** TL-2026-3573
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21658

## Description

CVE-2026-21658 is a pre-authentication code injection flaw (CWE-94, Improper Control of Generation of Code) in the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller. Certain input parameters are insufficiently validated, so a remote, unauthenticated attacker with network reachability to the controller interface can trigger unexpected actions; NVD describes the issue as unauthenticated remote code execution. Claroty Team82 (researcher Noam Moshe) discovered and reported it.

The flaw is one of six vulnerabilities disclosed together in CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) and Johnson Controls advisory JCI-PSA-2026-05: CVE-2026-21654 (OS command injection, CWE-78), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (code injection, CWE-94), CVE-2026-21659 (relative path traversal, CWE-23) and CVE-2026-21660 (plaintext password storage, CWE-256). CISA scores CVE-2026-21658 at CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the CNA CVSS v4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H with a base score of 8.8. Some aggregators report 9.8 with full confidentiality impact; the CISA vector is used here.

The affected releases (10.22 and earlier; Team82 lists 10.22 through 11) are legacy platforms that have reached end of support. Johnson Controls recommends upgrading to Quantum HD Unity version 12 or higher, then verifying compliance with the hardening guide and applying the security configuration. CISA reports no known public exploitation to it, and no public PoC, KEV listing or network IOCs are documented in the sources. The CISA advisory lists the Food and Agriculture sector, deployed worldwide. Because the flaw is pre-authentication, exposure of the controller network interface is the key risk factor; integrity and availability impact on refrigeration process control is high.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1565 Data Manipulation

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21658](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-21658)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD - CVE-2026-21658](https://nvd.nist.gov/vuln/detail/CVE-2026-21658)
- [Johnson Controls Product Security Advisory JCI-PSA-2026-05 (Frick Controls Quantum HD)](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Quantum HD Unity Software Update Procedure (vendor)](https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf)
- [Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD Industrial Refrigeration Controller](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [INCIBE-CERT - Multiples vulnerabilidades en Frick Controls Quantum HD de Johnson Controls](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-frick-controls-quantum-hd-de-johnson-controls-inc)
- [Rewterz Threat Advisory - ICS: Multiple Johnson Controls Frick Controls Quantum HD Vulnerabilities](https://rewterz.com/threat-advisory/ics-multiple-johnson-controls-frick-controls-quantum-hd-vulnerabilities)
- [Lutra Security Field Guide - CVE-2026-21658](https://fieldguide.lutrasecurity.com/CVE-2026-21658)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3573