Threat reportICS/SCADATL-2026-4350
CVE-2026-21660: Hardcoded Credentials in Johnson Controls Frick Controls Quantum HD Industrial Refrigeration Controller
CVE-2026-21660 (TL-2026-4350), also tracked as JCI-PSA-2026-05, is a medium-severity ICS/SCADA threat scored CVSS 6.2, first published 2026-10-24. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21660), maps to 6 MITRE ATT&CK techniques (T0859, T1005, T1078), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 6.2/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4350
- Threat ID
- TL-2026-4350
- Also known as
- JCI-PSA-2026-05, ICSA-26-057-01
- Severity
- MEDIUM
- CVSS
- 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Status
- PATCHED
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food and agriculture, cold storage, food processing, pharmaceutical manufacturing, industrial refrigeration
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-21660 works
CVE-2026-21660 is a hardcoded-credential flaw (plaintext email credentials embedded in firmware) in the legacy Johnson Controls Frick Controls Quantum HD controller, disclosed by Claroty Team82 via CISA ICSA-26-057-01. It can expose sensitive information and enable unauthorized access; the fix is migration to Quantum HD Unity 12 or later.
CVE-2026-21660 affects the Frick Controls Quantum HD, an industrial refrigeration controller used in food and agriculture environments (cold storage, food processing). Email credentials used by the device for notification or reporting functions are stored as plaintext inside the firmware. Anyone able to obtain or inspect the firmware image or the device's local data can recover these credentials. The CVE record classifies the weakness as CWE-256 (Plaintext Storage of a Password), with CWE-522 (Insufficiently Protected Credentials) also listed, and CAPEC-37 (Retrieve Embedded Sensitive Data). Per CISA, the impact is unauthorized access, exposure of sensitive information, and potential misuse or system compromise.
The CISA ICS advisory (ICSA-26-057-01, released 2026-02-26) rates the issue CVSS v3.1 6.2 MEDIUM (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); the CVE record carries a CVSS v4.0 score of 6.9 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). The local attack vector and confidentiality-only impact distinguish it from the other five CVEs in the same advisory (CVE-2026-21654, -21656, -21657, -21658 and -21659), which are pre-authentication injection, code-execution and path-traversal flaws rated 7.5-9.1. The Claroty Team82 dashboard lists affected versions as 10.22 through 11, while CISA and the CVE record state 10.22 and prior; defenders should treat every pre-Unity Quantum HD release as in scope. The product is legacy and end of support.
The issue was reported by Noam Moshe of Claroty Team82. CISA states it has received no reports of known public exploitation, and no public PoC or in-the-wild activity is documented in the sources reviewed. No network indicators (IPs, domains, hashes) are published, and no named threat actor is associated with it. Johnson Controls recommends upgrading to Quantum HD Unity version 12 or higher, then verifying the deployment against the hardening guide and applying the recommended security configurations (vendor advisory JCI-PSA-2026-05). Where upgrade is not immediately possible, isolate controllers on dedicated OT network segments, restrict remote access, and rotate/restrict the associated email account since its credential should be assumed exposed.
MITRE ATT&CK techniques used in TL-2026-4350
persistence
Collection
Initial Access
Persistence
Credential Access
Affected products and versions in CVE-2026-21660
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 and prior (CISA / CVE record); 10.22 through 11 (Claroty Team82 dashboard)
Fixed in: Quantum HD Unity 12 or later
Remediation for CVE-2026-21660
Patches
- Quantum HD Unity version 12 or higher
Immediate actions
- Upgrade to Quantum HD Unity version 12 or later per Johnson Controls advisory JCI-PSA-2026-05
- Treat the email account whose credentials are embedded in firmware as exposed; rotate its password and restrict its permissions and mail-relay use
- Restrict physical and engineering-workstation access to controller firmware images and local device data
Workarounds
- No vendor workaround documented for legacy versions beyond upgrade and network isolation
- Require VPN with MFA for any remote access to the OT network
Longer-term hardening
- Verify upgraded deployments against the Johnson Controls hardening guide and apply the recommended security configurations
- Plan retirement of legacy end-of-support Quantum HD controllers
- Isolate refrigeration controllers on dedicated OT segments behind industrial firewalls and keep them off the internet
- Monitor for anomalous logins or mail activity on accounts used by OT devices
CVEs associated with CVE-2026-21660
Weaknesses (CWE) in CVE-2026-21660
Timeline of CVE-2026-21660
- CVE-2026-21660 identifier reserved in the CVE program.
- CISA states no known public exploitation specifically targeting these Quantum HD vulnerabilities had been reported at publication.
- CISA advisory points to Johnson Controls Product Security Advisory JCI-PSA-2026-05 and directs upgrade to Quantum HD Unity 12+, followed by hardening-guide verification; affected versions listed as 10.22 and prior.
- CISA releases ICS advisory ICSA-26-057-01 covering six Frick Controls Quantum HD vulnerabilities, including CVE-2026-21660 (CVSS v3.1 6.2); no known public exploitation reported.
- CVE-2026-21660 published (hardcoded plaintext email credentials in Quantum HD firmware 10.22 and prior; CWE-256, CVSS v4.0 6.9); credited to Noam Moshe of Claroty Team82.
- Burns & McDonnell 1898 Advisories publishes analysis of the Quantum HD vulnerability cluster, recommending upgrade to Unity 12+ and OT network isolation.
- CVE record for CVE-2026-21660 last updated, referencing Johnson Controls advisory JCI-PSA-2026-05 and the upgrade to Quantum HD Unity 12 or above.
Sources cited for CVE-2026-21660
- CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD
- Claroty Team82 Disclosure Dashboard - CVE-2026-21660
- CVE Record - CVE-2026-21660
- NVD - CVE-2026-21660
- Johnson Controls Product Security Advisories
- Burns & McDonnell 1898 Advisories - Critical pre-authentication vulnerabilities in Frick Controls Quantum HD
- SentinelOne Vulnerability Database - CVE-2026-21660
- Rewterz Threat Advisory - ICS: Multiple Johnson Controls Frick Controls Quantum HD Vulnerabilities
Detection coverage for TL-2026-4350
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4350 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.