Threat reportICS/SCADATL-2026-4354
CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation)
CVE-2026-21657 (TL-2026-4354), also tracked as PSA-2026-05, is a critical-severity ICS/SCADA threat scored CVSS 9.1, first published 2026-10-24. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21657), maps to 4 MITRE ATT&CK techniques (T1005, T1059, T1190), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4354
- Threat ID
- TL-2026-4354
- Also known as
- PSA-2026-05, ICSA-26-057-01
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- Status
- ACTIVE
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food-and-agriculture, industrial-refrigeration, cold-storage, dairy, manufacturing
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-21657 works
CVE-2026-21657 is a pre-authentication code injection flaw (CWE-94) caused by insufficient input validation in Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 and prior, legacy/end-of-support). The vendor fix is an upgrade to Quantum HD Unity v12+ plus hardening; no public exploitation was reported to CISA at release.
CVE-2026-21657 affects the network-facing interface of Johnson Controls Frick Controls Quantum HD, a controller used for industrial refrigeration in food and agriculture environments. Insufficient validation of input in certain parameters, processed before user authentication, permits unexpected actions. NVD classifies it as Improper Control of Generation of Code (CWE-94). Only network reachability to the device is required; no credentials or user interaction are needed.
Scoring differs by source. CISA ICSA-26-057-01 (released 2026-02-26) lists CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). The NVD record (published 2026-02-27) lists a CVSS v3.1 9.8 (C:H/I:H/A:H) and a CVSS v4.0 8.8 score. Third-party summaries report 8.8 (v4) or 9.8 and describe operating-system-level code execution on the controller. The vector in this record follows the CISA advisory, which matches the hunt skeleton score of 9.1.
The flaw is one of six vulnerabilities in the same product disclosed together by Noam Moshe of Claroty Team82: CVE-2026-21654 (OS command injection, CWE-78), CVE-2026-21656 and CVE-2026-21658 (code injection, CWE-94), CVE-2026-21659 (path traversal / local file inclusion, CWE-23), and CVE-2026-21660 (plaintext hardcoded email credentials in firmware, CWE-256/CWE-798). Third-party analysis describes a possible chain of unauthenticated code injection for initial access followed by use of the hardcoded credentials. That chain is analyst inference and is not confirmed as observed exploitation.
The affected versions (10.22 through 11) are legacy, end-of-support platforms. Johnson Controls (advisory PSA-2026-05) recommends upgrading to Quantum HD Unity version 12 or higher, then verifying compliance with the hardening guide and applying all security configurations. CISA reported no known public exploitation specifically targeting these vulnerabilities, and no public exploit was reported at publication. The source material gives no ports, protocols, exploit payloads, or network IOCs, so none are recorded.
MITRE ATT&CK techniques used in TL-2026-4354
Collection
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
Affected products and versions in CVE-2026-21657
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 and prior; 10.22 through 11 (legacy, end-of-support)
Fixed in: Quantum HD Unity version 12 or higher
Remediation for CVE-2026-21657
Patches
- Upgrade to Frick Controls Quantum HD Unity version 12 or higher (Johnson Controls PSA-2026-05)
Immediate actions
- Identify Frick Controls Quantum HD controllers (10.22 and prior) and remove any direct internet exposure
- Place controllers on isolated OT network segments behind industrial firewalls
- Require VPN with multi-factor authentication for any remote access
- Monitor OT traffic for anomalous HTTP requests and unexpected command execution on controllers
Workarounds
- After upgrading, verify compliance with the Johnson Controls hardening guide and apply all security configurations
- Restrict network reachability of the device web interface to trusted management hosts only
Longer-term hardening
- Retire legacy, end-of-support Quantum HD platforms (10.22 through 11)
- Enforce zero-trust segmentation and east-west traffic monitoring for refrigeration control networks
- Apply egress policy enforcement for OT segments
CVEs associated with CVE-2026-21657
Weaknesses (CWE) in CVE-2026-21657
Timeline of CVE-2026-21657
- Johnson Controls publishes advisory PSA-2026-05 recommending upgrade to Quantum HD Unity version 12 or higher plus hardening configuration.
- CISA releases ICS advisory ICSA-26-057-01 covering six Frick Controls Quantum HD vulnerabilities, including CVE-2026-21657 (CVSS 9.1).
- Discovery credited to Noam Moshe of Claroty Team82; Team82 lists the CVE on its disclosure dashboard. CISA reports no known public exploitation targeting these vulnerabilities.
- Quantum HD Unity firmware version 12 and later, which remediates the vulnerability, reported available; Aviatrix and other analysts publish write-ups, reporting no public exploits.
- CVE-2026-21657 published in NVD as Improper Control of Generation of Code (CWE-94), CVSS v3.1 9.8 and v4.0 8.8 in the NVD record.
- Rewterz publishes a threat advisory summarizing the six Quantum HD vulnerabilities and pointing to PSA-2026-05.
Sources cited for CVE-2026-21657
- Claroty Team82 Disclosure Dashboard - CVE-2026-21657
- CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD
- NVD - CVE-2026-21657
- Johnson Controls Security Advisories
- Quantum HD Unity Software Update Procedure (vendor)
- Burns & McDonnell 1898 Advisories - Critical pre-authentication vulnerabilities in Frick Controls Quantum HD
- Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution
- Rewterz Threat Advisory - ICS: Multiple Johnson Controls Frick Controls Quantum HD Vulnerabilities
- CVEFeed - CVE-2026-21657
Detection coverage for TL-2026-4354
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4354 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.