# CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation)

> Frick Controls Quantum HD industrial refrigeration controllers (Johnson Controls) 10.22 and earlier contain a pre-authentication code injection flaw caused by insufficient validation of input in certain network-facing parameters. No public exploitation or public exploit is reported; the fix is migration to Quantum HD Unity version 12 or higher.

- **Published:** 2026-10-15T01:49:12Z
- **Last reviewed:** 2026-10-15T01:49:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3574
- **ID:** TL-2026-3574
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21657

## Description

CVE-2026-21657 is a code injection vulnerability (CWE-94) in the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller deployed globally in the Food and Agriculture sector (dairy, beverage processing, cold storage). The vendor states that insufficient validation of input in certain parameters may permit unexpected actions that could impact the security of the device before authentication occurs. Claroty Team82 lists affected versions as 10.22 through 11, while CISA ICSA-26-057-01 and the CVE/NVD record list 10.22 and earlier; all sources agree these are legacy platforms that have reached end of support.

The flaw is one of six vulnerabilities disclosed together by Noam Moshe of Claroty Research Team 82 in CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26): CVE-2026-21654 (OS command injection, CWE-78), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (code injection, CWE-94, each via a distinct network-facing parameter), CVE-2026-21659 (relative path traversal, CWE-23, 7.5) and CVE-2026-21660 (plaintext password storage, CWE-256, 6.2). CISA scores CVE-2026-21657 at CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). The NVD/CNA record lists a different score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 score of 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H); this record uses the CISA/Claroty 9.1 score and notes the discrepancy.

Exploitation requires only network reachability of the device interface; no authentication or user interaction is needed. Advisory impact language covers pre-authentication remote code execution, information leak or denial of service across the cluster. Per CISA and third-party analyses, no known public exploitation and no public exploit have been reported, and exact ports/URIs are not disclosed in any advisory. Third-party analysis (Aviatrix) describes a plausible follow-on chain of unauthenticated code injection, privilege escalation using the hardcoded/plaintext credentials of sibling CVE-2026-21660, lateral movement, and operational disruption; this is analyst inference rather than observed activity. Remediation per Johnson Controls: upgrade to Quantum HD Unity version 12 or higher and then verify compliance with the hardening guide and apply all recommended security configurations. Because no network IOCs are published, no BeaconBeagle C2 correlation was applicable.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1082 System Information Discovery
- T1078.001 Default Accounts
- T1552.001 Credentials In Files
- T1005 Data from Local System

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21657](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-21657)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD - CVE-2026-21657](https://nvd.nist.gov/vuln/detail/CVE-2026-21657)
- [CVE.org record - CVE-2026-21657](https://cveawg.mitre.org/api/cve/CVE-2026-21657)
- [Johnson Controls Security Advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution](https://aviatrix.ai/threat-research-center/johnson-controls-2026-unauthenticated-remote-code-execution/)
- [CraftedSignal - Quantum HD Vulnerabilities Brief](https://feed.craftedsignal.io/briefs/2026-02-quantum-hd-vulns/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3574