Threat reportICS/SCADATL-2026-3575
CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection Vulnerability
CVE-2026-21656 (TL-2026-3575), also tracked as ICSA-26-057-01, is a critical-severity ICS/SCADA threat scored CVSS 9.1, first published 2026-10-15. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21656), maps to 8 MITRE ATT&CK techniques (T0814, T1059, T1059.004), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-3575
- Threat ID
- TL-2026-3575
- Also known as
- ICSA-26-057-01, JCI-PSA-2026-05
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- Status
- ACTIVE
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food-and-agriculture, industrial-refrigeration, cold-storage, manufacturing
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 6
How CVE-2026-21656 works
CVE-2026-21656 is a CWE-94 code injection flaw in Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 and prior) caused by insufficient input validation in certain parameters, affecting device security before authentication. The platform is end-of-support; the fix is migration to Quantum HD Unity 12 or higher.
CVE-2026-21656 is an improper control of generation of code ('Code Injection', CWE-94) vulnerability in the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller. Per the CVE record and Claroty Team82's disclosure, insufficient validation of input in certain parameters may permit unexpected actions that could impact the security of the device before authentication occurs. Affected versions are listed as 10.22 and prior by CISA/CVE (Claroty lists 10.22 through 11); these legacy platforms have reached end of support.
The flaw was reported by Noam Moshe of Claroty Research Team82 and disclosed in CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26; CVE published 2026-02-27) together with five sibling vulnerabilities: CVE-2026-21654 (CWE-78 OS command injection), CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection), CVE-2026-21659 (CWE-23 relative path traversal enabling unauthenticated code execution) and CVE-2026-21660 (plaintext/hardcoded password storage). CISA scores CVE-2026-21656 at CVSS v3.1 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the CVE record also carries a CVSS v4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). The Claroty page states 9.1 without a vector.
Third-party analysis (Burns & McDonnell 1898 advisories) describes network-based, pre-authentication exploitation requiring only reachability to the controller's web application/network-facing parameters, with potential arbitrary code execution on the controller, manipulation of compressor setpoints, equipment damage, product spoilage and lateral movement in the OT network. These impact statements are secondary-source assessments rather than vendor-confirmed. CISA reported no known public exploitation at the time of the advisory, and Aviatrix notes no public exploit. No PoC, exploit code, network indicators or named threat actor are documented in any source; the product is deployed worldwide, with CISA tagging the Food and Agriculture sector.
Remediation per Johnson Controls (advisory JCI-PSA-2026-05): upgrade to Quantum HD Unity version 12 or higher and, after the upgrade, verify compliance with the hardening guide and apply all recommended security configurations. Compensating controls for devices that cannot be upgraded include placing controllers behind industrial firewalls, removing internet exposure, restricting access to MFA-protected VPN, and OT network monitoring.
MITRE ATT&CK techniques used in TL-2026-3575
inhibit-response-function
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery
Credential Access
T1552.001 Credentials In Files
Reconnaissance
Affected products and versions in CVE-2026-21656
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 and prior (CISA/CVE); 10.22 through 11 (Claroty)
Fixed in: Quantum HD Unity 12 or higher
Remediation for CVE-2026-21656
Patches
- Upgrade to Quantum HD Unity version 12 or higher per Johnson Controls advisory JCI-PSA-2026-05
Immediate actions
- Identify all Frick Controls Quantum HD controllers (10.22 and prior) and audit for internet or flat-network reachability
- Isolate controllers behind industrial firewalls and remove direct internet exposure
- Restrict remote access to a VPN with multi-factor authentication
Workarounds
- Network segmentation and firewall allow-listing of engineering and HMI hosts only
- Disable or block external access to the controller web interface until the upgrade is completed
Longer-term hardening
- Migrate end-of-support Quantum HD 10.22-11 platforms to Quantum HD Unity version 12 or higher
- Verify compliance with the Johnson Controls hardening guide and apply all recommended security configurations after upgrade
- Deploy OT network monitoring and anomaly detection for refrigeration controller traffic
CVEs associated with CVE-2026-21656
Weaknesses (CWE) in CVE-2026-21656
Timeline of CVE-2026-21656
- CVE-2026-21656 identifier reserved in the CVE program
- Johnson Controls publishes Product Security Advisory JCI-PSA-2026-05 recommending upgrade to Quantum HD Unity 12 or higher
- CISA releases ICS Advisory ICSA-26-057-01 covering six Frick Controls Quantum HD vulnerabilities (CVE-2026-21654, -21656, -21657, -21658, -21659, -21660), reported by Noam Moshe of Claroty Team82
- No known public exploitation reported to CISA at advisory time; third-party analysis found no public exploit
- CVE-2026-21656 published (CWE-94, CVSS v4.0 8.8) and Claroty Team82 disclosure dashboard entry lists CVSS 9.1
- Burns & McDonnell publishes technical advisory on the pre-authentication Quantum HD vulnerabilities; CVE record last updated
Sources cited for CVE-2026-21656
- Claroty Team82 Disclosure Dashboard - CVE-2026-21656
- CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD
- CVE Record CVE-2026-21656
- Johnson Controls Product Security Advisories
- Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD
- Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution
- CraftedSignal Brief - Quantum HD Vulnerabilities
- CVEfeed - CVE-2026-21656
Detection coverage for TL-2026-3575
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3575 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.