Threat reportICS/SCADATL-2026-4352
CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD Unauthenticated Local File Inclusion Leading to Remote Code Execution
CVE-2026-21659 (TL-2026-4352), also tracked as ICSA-26-057-01, is a high-severity ICS/SCADA threat scored CVSS 7.5, first published 2026-10-24. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 2 CVEs (CVE-2026-21659, CVE-2026-21658), maps to 4 MITRE ATT&CK techniques (T0819, T1005, T1059), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 7.5/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4352
- Threat ID
- TL-2026-4352
- Also known as
- ICSA-26-057-01, JCI-PSA-2026-05
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Status
- TRACKING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food-and-agriculture, industrial-refrigeration, cold-storage, critical-manufacturing
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-21659 works
Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 and prior, i.e. the 10.22-11 legacy platform) contain a relative path traversal / local file inclusion flaw that lets an unauthenticated network attacker read files and execute arbitrary code, leading to full system compromise. The affected platforms are end-of-support; Johnson Controls recommends upgrading to Quantum HD Unity v12 or higher.
CVE-2026-21659 is described in the CVE record as an unauthenticated remote code execution and information disclosure issue caused by a Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD. An unauthenticated attacker with network access to the device interface can execute arbitrary code on the controller, leading to full system compromise. CISA classifies the weakness as CWE-23 (Relative Path Traversal); NVD additionally lists CWE-22.
The flaw was reported by Noam Moshe of Claroty Research Team 82 and disclosed on 2026-02-26/27 through CISA ICS advisory ICSA-26-057-01 and Johnson Controls advisory JCI-PSA-2026-05. It is one of six vulnerabilities in the same product: CVE-2026-21654 (OS command injection, CWE-78, CVSS 9.1), CVE-2026-21656/21657/21658 (code injection, CWE-94, CVSS 9.1 each), CVE-2026-21659 (this issue, CVSS 7.5) and CVE-2026-21660 (credential weakness, CVSS 6.2). Burns & McDonnell notes the path traversal can be chained with the injection flaws.
Scoring differs by source. CISA/CNA: CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CVSS v4.0 8.7 (VC:H). NVD's own v3.1 assessment: 9.8 (C:H/I:H/A:H). This record uses the CISA/CNA 7.5 score, which matches the hunt skeleton.
Quantum HD 10.22 through 11 are legacy platforms that have reached end of support, so the fix is a platform migration to Quantum HD Unity v12 or higher, followed by verifying compliance with the vendor hardening guide. Quantum HD is an industrial refrigeration controller; CISA lists the affected sector as Food and Agriculture, with worldwide deployment and vendor headquarters in Ireland. None of the reviewed sources report active exploitation, a public PoC, KEV listing, or any network IOCs.
MITRE ATT&CK techniques used in TL-2026-4352
Initial Access
T0819 Exploit Public-Facing Application; T1190 Exploit Public-Facing Application
Collection
Execution
Affected products and versions in CVE-2026-21659
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 and prior; 10.22 through 11 (legacy, end of support)
Fixed in: Quantum HD Unity 12 or higher
Remediation for CVE-2026-21659
Patches
- Upgrade to Frick Controls Quantum HD Unity version 12 or higher (see JCI-PSA-2026-05 and the Quantum HD Unity Software Update Procedure)
Immediate actions
- Isolate Quantum HD controllers from the internet and untrusted networks; audit for internet-reachable instances
- Place controllers behind industrial firewalls and require VPN with MFA for remote access
- Monitor OT network traffic for anomalous HTTP requests to the controller and unexpected command execution
Workarounds
- Minimize network exposure of the controller interface; no vendor workaround other than isolation is documented for end-of-support versions
Longer-term hardening
- Retire legacy Quantum HD 10.22-11 platforms that are end of support
- Verify compliance with the Johnson Controls hardening guide after upgrade and apply all recommended security configurations
CVEs associated with CVE-2026-21659
Weaknesses (CWE) in CVE-2026-21659
Timeline of CVE-2026-21659
- CVE-2026-21659 identifier reserved in the CVE program.
- Johnson Controls publishes product security advisory JCI-PSA-2026-05 with upgrade and hardening guidance; Quantum HD 10.22-11 declared end-of-support legacy platforms and Quantum HD Unity v12+ recommended.
- CISA releases ICS advisory ICSA-26-057-01 covering six Frick Controls Quantum HD vulnerabilities (CVE-2026-21654, -21656, -21657, -21658, -21659, -21660), credited to Noam Moshe of Claroty Team82.
- NVD lists its own CVSS v3.1 assessment of 9.8 and weaknesses CWE-22/CWE-23, differing from the CNA/CISA 7.5 score.
- CVE-2026-21659 published (LFI leading to unauthenticated RCE and information disclosure); CNA scores CVSS v3.1 7.5 and v4.0 8.7.
- Burns & McDonnell 1898 Advisories publishes analysis of the six pre-authentication Quantum HD flaws, noting CVE-2026-21659 can be exploited independently or chained with the injection vulnerabilities.
- CVE record updated (per Lutra Security Field Guide).
- NVD record last modified; NVD retains its own CVSS v3.1 9.8 assessment alongside the CNA 7.5/8.7 scores.
Sources cited for CVE-2026-21659
- Claroty Team82 Disclosure Dashboard - CVE-2026-21659
- CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD
- NVD - CVE-2026-21659
- Lutra Security Field Guide - CVE-2026-21659
- Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD
- INCIBE-CERT - Multiple vulnerabilities in Frick Controls Quantum HD
- Mondoo Vulnerability Intelligence - CVE-2026-21659
- Rewterz - ICS Multiple Johnson Controls Frick Controls Quantum HD Vulnerabilities
- Claroty Team82 Disclosure Dashboard - CVE-2026-21658 (sibling code injection)
Detection coverage for TL-2026-4352
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4352 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.