# CVE-2026-21654 - Johnson Controls Frick Controls Quantum HD Pre-Authentication OS Command Injection (ICSA-26-057-01)

> CVE-2026-21654 is a pre-authentication OS command injection (CWE-78) in Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 and prior; versions 10.22-11 are end-of-support). A remote unauthenticated attacker can send crafted input to certain parameters and execute commands on the device; no public exploitation has been reported.

- **Published:** 2026-10-15T02:19:30Z
- **Last reviewed:** 2026-10-15T02:19:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3576
- **ID:** TL-2026-3576
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21654

## Description

Frick Controls Quantum HD is an industrial refrigeration controller from Johnson Controls used in food and agriculture facilities (food production, beverage, dairy and cold storage). CVE-2026-21654 stems from insufficient validation of input in certain parameters, which may permit unexpected actions that could impact the security of the device before authentication occurs. CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) classifies it as CWE-78 (OS Command Injection) with a CVSS v3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). NVD lists CWE-78 and additionally shows a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 8.8; this record uses the CISA/CNA 9.1 value.

The flaw is one of six vulnerabilities disclosed together by Johnson Controls: CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection, CVSS 9.1), CVE-2026-21659 (CWE-23 relative path traversal, CVSS 7.5) and CVE-2026-21660 (hardcoded credentials, CVSS 6.2, local vector). The vulnerabilities were reported by Noam Moshe of Claroty Research Team82. Third-party analysis (Aviatrix, CraftedSignal) describes the cluster as enabling pre-authentication remote code execution via specially crafted requests; the specific vulnerable endpoints and parameters have not been publicly documented in the sources reviewed.

Exploitation status: CISA states no known public exploitation was reported, and no public PoC was identified in the sources. Aviatrix presents a generic, non-incident-based attack chain (initial access through code injection, use of hardcoded plaintext credentials, lateral movement, C2, exfiltration of operational data and configurations, and disruptive commands) as the plausible risk. No network IOCs (IPs, domains, hashes) have been published, so BeaconBeagle correlation had no network indicators to check.

Remediation: Johnson Controls recommends upgrading to Quantum HD Unity version 12 or higher, verifying compliance with the hardening guide and applying all security configurations (JCI-PSA-2026-05). Versions 10.22-11 are legacy platforms that have reached end of support, so no patch exists for them; compensating controls are network isolation, firewalling, and VPN for remote access.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1082 System Information Discovery
- T1552.001 Credentials In Files
- T1078.001 Default Accounts
- T1021 Remote Services
- T1071 Application Layer Protocol

## Sources

- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD - CVE-2026-21654](https://nvd.nist.gov/vuln/detail/cve-2026-21654)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-21654](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-21654)
- [Johnson Controls Product Security Advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Aviatrix Threat Research - Johnson Controls 2026 Unauthenticated Remote Code Execution](https://aviatrix.ai/threat-research-center/johnson-controls-2026-unauthenticated-remote-code-execution/)
- [Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [CraftedSignal Brief - Quantum HD Vulnerabilities](https://feed.craftedsignal.io/briefs/2026-02-quantum-hd-vulns/)
- [CVE Record - CVE-2026-21654 (MITRE CVE AWG)](https://cveawg.mitre.org/api/cve/CVE-2026-21654)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3576