# CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection Vulnerability

> CVE-2026-21656 is a CWE-94 code injection flaw in Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 and prior) caused by insufficient input validation in certain parameters, affecting device security before authentication. The platform is end-of-support; the fix is migration to Quantum HD Unity 12 or higher.

- **Published:** 2026-10-15T02:06:10Z
- **Last reviewed:** 2026-10-15T02:06:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3575
- **ID:** TL-2026-3575
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21656

## Description

CVE-2026-21656 is an improper control of generation of code ('Code Injection', CWE-94) vulnerability in the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller. Per the CVE record and Claroty Team82's disclosure, insufficient validation of input in certain parameters may permit unexpected actions that could impact the security of the device before authentication occurs. Affected versions are listed as 10.22 and prior by CISA/CVE (Claroty lists 10.22 through 11); these legacy platforms have reached end of support.

The flaw was reported by Noam Moshe of Claroty Research Team82 and disclosed in CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26; CVE published 2026-02-27) together with five sibling vulnerabilities: CVE-2026-21654 (CWE-78 OS command injection), CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection), CVE-2026-21659 (CWE-23 relative path traversal enabling unauthenticated code execution) and CVE-2026-21660 (plaintext/hardcoded password storage). CISA scores CVE-2026-21656 at CVSS v3.1 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the CVE record also carries a CVSS v4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). The Claroty page states 9.1 without a vector.

Third-party analysis (Burns & McDonnell 1898 advisories) describes network-based, pre-authentication exploitation requiring only reachability to the controller's web application/network-facing parameters, with potential arbitrary code execution on the controller, manipulation of compressor setpoints, equipment damage, product spoilage and lateral movement in the OT network. These impact statements are secondary-source assessments rather than vendor-confirmed. CISA reported no known public exploitation at the time of the advisory, and Aviatrix notes no public exploit. No PoC, exploit code, network indicators or named threat actor are documented in any source; the product is deployed worldwide, with CISA tagging the Food and Agriculture sector.

Remediation per Johnson Controls (advisory JCI-PSA-2026-05): upgrade to Quantum HD Unity version 12 or higher and, after the upgrade, verify compliance with the hardening guide and apply all recommended security configurations. Compensating controls for devices that cannot be upgraded include placing controllers behind industrial firewalls, removing internet exposure, restricting access to MFA-protected VPN, and OT network monitoring.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1078 Valid Accounts
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T0814 Denial of Service

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21656](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-21656)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [CVE Record CVE-2026-21656](https://cveawg.mitre.org/api/cve/CVE-2026-21656)
- [Johnson Controls Product Security Advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution](https://aviatrix.ai/threat-research-center/johnson-controls-2026-unauthenticated-remote-code-execution/)
- [CraftedSignal Brief - Quantum HD Vulnerabilities](https://feed.craftedsignal.io/briefs/2026-02-quantum-hd-vulns/)
- [CVEfeed - CVE-2026-21656](https://cvefeed.io/vuln/detail/CVE-2026-21656)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3575