Threat reportICS/SCADATL-2026-3574
CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation)
CVE-2026-21657 (TL-2026-3574), also tracked as ICSA-26-057-01, is a critical-severity ICS/SCADA threat scored CVSS 9.1, first published 2026-10-15. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21657), maps to 8 MITRE ATT&CK techniques (T1005, T1059, T1059.004), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-3574
- Threat ID
- TL-2026-3574
- Also known as
- ICSA-26-057-01
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- Status
- MONITORING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food-and-agriculture, dairy, beverage-processing, cold-storage, industrial-refrigeration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
Malware and tooling in CVE-2026-21657
Malware and tooling: DAIRY
How CVE-2026-21657 works
Frick Controls Quantum HD industrial refrigeration controllers (Johnson Controls) 10.22 and earlier contain a pre-authentication code injection flaw caused by insufficient validation of input in certain network-facing parameters. No public exploitation or public exploit is reported; the fix is migration to Quantum HD Unity version 12 or higher.
CVE-2026-21657 is a code injection vulnerability (CWE-94) in the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller deployed globally in the Food and Agriculture sector (dairy, beverage processing, cold storage). The vendor states that insufficient validation of input in certain parameters may permit unexpected actions that could impact the security of the device before authentication occurs. Claroty Team82 lists affected versions as 10.22 through 11, while CISA ICSA-26-057-01 and the CVE/NVD record list 10.22 and earlier; all sources agree these are legacy platforms that have reached end of support.
The flaw is one of six vulnerabilities disclosed together by Noam Moshe of Claroty Research Team 82 in CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26): CVE-2026-21654 (OS command injection, CWE-78), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (code injection, CWE-94, each via a distinct network-facing parameter), CVE-2026-21659 (relative path traversal, CWE-23, 7.5) and CVE-2026-21660 (plaintext password storage, CWE-256, 6.2). CISA scores CVE-2026-21657 at CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). The NVD/CNA record lists a different score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 score of 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H); this record uses the CISA/Claroty 9.1 score and notes the discrepancy.
Exploitation requires only network reachability of the device interface; no authentication or user interaction is needed. Advisory impact language covers pre-authentication remote code execution, information leak or denial of service across the cluster. Per CISA and third-party analyses, no known public exploitation and no public exploit have been reported, and exact ports/URIs are not disclosed in any advisory. Third-party analysis (Aviatrix) describes a plausible follow-on chain of unauthenticated code injection, privilege escalation using the hardcoded/plaintext credentials of sibling CVE-2026-21660, lateral movement, and operational disruption; this is analyst inference rather than observed activity. Remediation per Johnson Controls: upgrade to Quantum HD Unity version 12 or higher and then verify compliance with the hardening guide and apply all recommended security configurations. Because no network IOCs are published, no BeaconBeagle C2 correlation was applicable.
MITRE ATT&CK techniques used in TL-2026-3574
Collection
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Privilege Escalation
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1552.001 Credentials In Files
Reconnaissance
Affected products and versions in CVE-2026-21657
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 and earlier; 10.22 through 11 (per Claroty Team82)
Fixed in: Quantum HD Unity 12 or higher
Remediation for CVE-2026-21657
Patches
- Upgrade to Frick Controls Quantum HD Unity version 12 or higher (Johnson Controls Quantum HD Unity Software Update Procedure)
Immediate actions
- Identify all Frick Controls Quantum HD controllers running 10.22 through 11 and prioritize any that are internet-reachable for isolation
- Isolate controllers on dedicated OT network segments behind industrial firewalls
- Restrict remote access to VPN with multi-factor authentication
- Deploy OT network monitoring for anomalous or malformed requests to the Quantum HD web interface
Workarounds
- No in-place patch for versions 10.22-11 (end of support); rely on network isolation and access restriction until upgraded
Longer-term hardening
- Migrate end-of-support Quantum HD platforms to Quantum HD Unity version 12 or higher
- Verify compliance with the vendor hardening guide and apply all recommended security configurations
- Apply zero-trust segmentation and egress controls for OT assets
CVEs associated with CVE-2026-21657
Weaknesses (CWE) in CVE-2026-21657
Timeline of CVE-2026-21657
- At advisory release CISA reports no known public exploitation of any of the six Quantum HD vulnerabilities; all affected releases (10.22 and earlier) are end of support
- CISA releases ICS Advisory ICSA-26-057-01 covering six Frick Controls Quantum HD vulnerabilities (CVE-2026-21654, -21656, -21657, -21658, -21659, -21660), credited to Noam Moshe of Claroty Research Team 82
- Sibling flaws published together: CVE-2026-21654 (OS command injection), CVE-2026-21656 and CVE-2026-21658 (code injection), CVE-2026-21659 (path traversal), CVE-2026-21660 (plaintext password storage)
- Johnson Controls remediation guidance: upgrade to Quantum HD Unity version 12 or higher; versions 10.22-11 are end of support
- CVE-2026-21657 published in CVE/NVD as a CWE-94 code injection flaw affecting Quantum HD 10.22 and earlier
- CraftedSignal publishes a threat brief on the Quantum HD vulnerabilities describing unauthenticated crafted-request exploitation and URI-pattern detection guidance (feed path dated 2026-02)
- Burns & McDonnell 1898 Advisories publishes guidance on the pre-authentication Quantum HD vulnerabilities, noting no active exploitation reported
Sources cited for CVE-2026-21657
- Claroty Team82 Disclosure Dashboard - CVE-2026-21657
- CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD
- NVD - CVE-2026-21657
- CVE.org record - CVE-2026-21657
- Johnson Controls Security Advisories
- Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD
- Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution
- CraftedSignal - Quantum HD Vulnerabilities Brief
Detection coverage for TL-2026-3574
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3574 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.