# CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD Unauthenticated Local File Inclusion Leading to Remote Code Execution

> Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 and prior, i.e. the 10.22-11 legacy platform) contain a relative path traversal / local file inclusion flaw that lets an unauthenticated network attacker read files and execute arbitrary code, leading to full system compromise. The affected platforms are end-of-support; Johnson Controls recommends upgrading to Quantum HD Unity v12 or higher.

- **Published:** 2026-10-24T06:58:51Z
- **Last reviewed:** 2026-10-24T06:58:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4352
- **ID:** TL-2026-4352
- **Severity:** HIGH (CVSS 7.5)
- **Category:** ICS_SCADA
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21659, CVE-2026-21658

## Description

CVE-2026-21659 is described in the CVE record as an unauthenticated remote code execution and information disclosure issue caused by a Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD. An unauthenticated attacker with network access to the device interface can execute arbitrary code on the controller, leading to full system compromise. CISA classifies the weakness as CWE-23 (Relative Path Traversal); NVD additionally lists CWE-22.

The flaw was reported by Noam Moshe of Claroty Research Team 82 and disclosed on 2026-02-26/27 through CISA ICS advisory ICSA-26-057-01 and Johnson Controls advisory JCI-PSA-2026-05. It is one of six vulnerabilities in the same product: CVE-2026-21654 (OS command injection, CWE-78, CVSS 9.1), CVE-2026-21656/21657/21658 (code injection, CWE-94, CVSS 9.1 each), CVE-2026-21659 (this issue, CVSS 7.5) and CVE-2026-21660 (credential weakness, CVSS 6.2). Burns & McDonnell notes the path traversal can be chained with the injection flaws.

Scoring differs by source. CISA/CNA: CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CVSS v4.0 8.7 (VC:H). NVD's own v3.1 assessment: 9.8 (C:H/I:H/A:H). This record uses the CISA/CNA 7.5 score, which matches the hunt skeleton.

Quantum HD 10.22 through 11 are legacy platforms that have reached end of support, so the fix is a platform migration to Quantum HD Unity v12 or higher, followed by verifying compliance with the vendor hardening guide. Quantum HD is an industrial refrigeration controller; CISA lists the affected sector as Food and Agriculture, with worldwide deployment and vendor headquarters in Ireland. None of the reviewed sources report active exploitation, a public PoC, KEV listing, or any network IOCs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1005 Data from Local System
- T0819 Exploit Public-Facing Application

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21659](https://br.claroty.com/team82/disclosure-dashboard/cve-2026-21659)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD - CVE-2026-21659](https://nvd.nist.gov/vuln/detail/cve-2026-21659)
- [Lutra Security Field Guide - CVE-2026-21659](https://fieldguide.lutrasecurity.com/CVE-2026-21659)
- [Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [INCIBE-CERT - Multiple vulnerabilities in Frick Controls Quantum HD](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-frick-controls-quantum-hd-de-johnson-controls-inc)
- [Mondoo Vulnerability Intelligence - CVE-2026-21659](https://mondoo.com/vulnerability-intelligence/vulnerability/CVE-2026-21659)
- [Rewterz - ICS Multiple Johnson Controls Frick Controls Quantum HD Vulnerabilities](https://rewterz.com/threat-advisory/ics-multiple-johnson-controls-frick-controls-quantum-hd-vulnerabilities)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-21658 (sibling code injection)](https://br.claroty.com/team82/disclosure-dashboard/cve-2026-21658)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4352