Threat reportICS/SCADATL-2026-3576
CVE-2026-21654 - Johnson Controls Frick Controls Quantum HD Pre-Authentication OS Command Injection (ICSA-26-057-01)
CVE-2026-21654 (TL-2026-3576), also tracked as ICSA-26-057-01, is a critical-severity ICS/SCADA threat scored CVSS 9.1, first published 2026-10-15. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21654), maps to 9 MITRE ATT&CK techniques (T1021, T1059, T1059.004), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-3576
- Threat ID
- TL-2026-3576
- Also known as
- ICSA-26-057-01, JCI-PSA-2026-05
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- Status
- ACTIVE
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food and agriculture, food production, beverage, dairy, cold storage, industrial refrigeration
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 6
Malware and tooling in CVE-2026-21654
Malware and tooling: DAIRY
How CVE-2026-21654 works
CVE-2026-21654 is a pre-authentication OS command injection (CWE-78) in Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 and prior; versions 10.22-11 are end-of-support). A remote unauthenticated attacker can send crafted input to certain parameters and execute commands on the device; no public exploitation has been reported.
Frick Controls Quantum HD is an industrial refrigeration controller from Johnson Controls used in food and agriculture facilities (food production, beverage, dairy and cold storage). CVE-2026-21654 stems from insufficient validation of input in certain parameters, which may permit unexpected actions that could impact the security of the device before authentication occurs. CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) classifies it as CWE-78 (OS Command Injection) with a CVSS v3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). NVD lists CWE-78 and additionally shows a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 8.8; this record uses the CISA/CNA 9.1 value.
The flaw is one of six vulnerabilities disclosed together by Johnson Controls: CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection, CVSS 9.1), CVE-2026-21659 (CWE-23 relative path traversal, CVSS 7.5) and CVE-2026-21660 (hardcoded credentials, CVSS 6.2, local vector). The vulnerabilities were reported by Noam Moshe of Claroty Research Team82. Third-party analysis (Aviatrix, CraftedSignal) describes the cluster as enabling pre-authentication remote code execution via specially crafted requests; the specific vulnerable endpoints and parameters have not been publicly documented in the sources reviewed.
Exploitation status: CISA states no known public exploitation was reported, and no public PoC was identified in the sources. Aviatrix presents a generic, non-incident-based attack chain (initial access through code injection, use of hardcoded plaintext credentials, lateral movement, C2, exfiltration of operational data and configurations, and disruptive commands) as the plausible risk. No network IOCs (IPs, domains, hashes) have been published, so BeaconBeagle correlation had no network indicators to check.
Remediation: Johnson Controls recommends upgrading to Quantum HD Unity version 12 or higher, verifying compliance with the hardening guide and applying all security configurations (JCI-PSA-2026-05). Versions 10.22-11 are legacy platforms that have reached end of support, so no patch exists for them; compensating controls are network isolation, firewalling, and VPN for remote access.
MITRE ATT&CK techniques used in TL-2026-3576
Lateral Movement
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078.001 Default Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery
Credential Access
T1552.001 Credentials In Files
Reconnaissance
Affected products and versions in CVE-2026-21654
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 and prior; 10.22 through 11 (end of support)
Fixed in: Quantum HD Unity 12 and later
Remediation for CVE-2026-21654
Patches
- Upgrade to Quantum HD Unity version 12 or higher (Quantum_HD_Unity_Software_Update_Procedure.pdf)
- Johnson Controls advisory JCI-PSA-2026-05
Immediate actions
- Inventory Frick Controls Quantum HD controllers and identify versions 10.22 and prior
- Remove Quantum HD web/management interfaces from direct internet exposure
- Isolate controllers on dedicated OT network segments behind firewalls
- Restrict remote access to VPN with multi-factor authentication
Workarounds
- Network isolation and firewall protection of controllers
- VPN-only remote access
- Zero-trust segmentation and egress policy enforcement to limit lateral movement
Longer-term hardening
- Migrate end-of-support Quantum HD 10.22-11 platforms to Quantum HD Unity
- Apply the Johnson Controls hardening guide and all security configurations after upgrade
- Monitor OT network traffic to Quantum HD web interfaces for anomalous requests
CVEs associated with CVE-2026-21654
Weaknesses (CWE) in CVE-2026-21654
Timeline of CVE-2026-21654
- CraftedSignal publishes a brief on the six Quantum HD CVEs with detection guidance for web interface access and code-injection URI strings
- Johnson Controls advises upgrading to Quantum HD Unity 12 or higher and applying the hardening guide (JCI-PSA-2026-05); versions 10.22-11 are end of support
- Noam Moshe of Claroty Research Team82 is credited with reporting the vulnerabilities; the exact date of discovery or report is not stated in the sources
- CISA releases ICS Advisory ICSA-26-057-01 covering six Frick Controls Quantum HD vulnerabilities including CVE-2026-21654 (CVSS v3.1 9.1, CWE-78)
- Aviatrix publishes analysis of the vulnerability cluster as pre-authentication RCE affecting food and agriculture; no public exploit noted
- NVD publishes CVE-2026-21654 as OS Command Injection (CWE-78), listing CVSS v3.1 9.8 and CVSS v4.0 8.8 alongside the CISA 9.1 score
- Burns & McDonnell 1898 Advisories publishes guidance on the pre-authentication flaws (CVE-2026-21654, -21656, -21657, -21658), warning of compressor manipulation, product spoilage and downtime, and urging audit of internet-reachable controllers
Sources cited for CVE-2026-21654
- CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD
- NVD - CVE-2026-21654
- Claroty Team82 Disclosure Dashboard - CVE-2026-21654
- Johnson Controls Product Security Advisories
- Aviatrix Threat Research - Johnson Controls 2026 Unauthenticated Remote Code Execution
- Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD
- CraftedSignal Brief - Quantum HD Vulnerabilities
- CVE Record - CVE-2026-21654 (MITRE CVE AWG)
Detection coverage for TL-2026-3576
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3576 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.