# CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation)

> CVE-2026-21657 is a pre-authentication code injection flaw (CWE-94) caused by insufficient input validation in Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 and prior, legacy/end-of-support). The vendor fix is an upgrade to Quantum HD Unity v12+ plus hardening; no public exploitation was reported to CISA at release.

- **Published:** 2026-10-24T07:25:42Z
- **Last reviewed:** 2026-10-24T07:25:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4354
- **ID:** TL-2026-4354
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21657

## Description

CVE-2026-21657 affects the network-facing interface of Johnson Controls Frick Controls Quantum HD, a controller used for industrial refrigeration in food and agriculture environments. Insufficient validation of input in certain parameters, processed before user authentication, permits unexpected actions. NVD classifies it as Improper Control of Generation of Code (CWE-94). Only network reachability to the device is required; no credentials or user interaction are needed.

Scoring differs by source. CISA ICSA-26-057-01 (released 2026-02-26) lists CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). The NVD record (published 2026-02-27) lists a CVSS v3.1 9.8 (C:H/I:H/A:H) and a CVSS v4.0 8.8 score. Third-party summaries report 8.8 (v4) or 9.8 and describe operating-system-level code execution on the controller. The vector in this record follows the CISA advisory, which matches the hunt skeleton score of 9.1.

The flaw is one of six vulnerabilities in the same product disclosed together by Noam Moshe of Claroty Team82: CVE-2026-21654 (OS command injection, CWE-78), CVE-2026-21656 and CVE-2026-21658 (code injection, CWE-94), CVE-2026-21659 (path traversal / local file inclusion, CWE-23), and CVE-2026-21660 (plaintext hardcoded email credentials in firmware, CWE-256/CWE-798). Third-party analysis describes a possible chain of unauthenticated code injection for initial access followed by use of the hardcoded credentials. That chain is analyst inference and is not confirmed as observed exploitation.

The affected versions (10.22 through 11) are legacy, end-of-support platforms. Johnson Controls (advisory PSA-2026-05) recommends upgrading to Quantum HD Unity version 12 or higher, then verifying compliance with the hardening guide and applying all security configurations. CISA reported no known public exploitation specifically targeting these vulnerabilities, and no public exploit was reported at publication. The source material gives no ports, protocols, exploit payloads, or network IOCs, so none are recorded.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1552.001 Credentials In Files
- T1005 Data from Local System

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21657](https://br.claroty.com/team82/disclosure-dashboard/cve-2026-21657)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD - CVE-2026-21657](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-21657)
- [Johnson Controls Security Advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Quantum HD Unity Software Update Procedure (vendor)](https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf)
- [Burns & McDonnell 1898 Advisories - Critical pre-authentication vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution](https://aviatrix.ai/threat-research-center/johnson-controls-2026-unauthenticated-remote-code-execution/)
- [Rewterz Threat Advisory - ICS: Multiple Johnson Controls Frick Controls Quantum HD Vulnerabilities](https://rewterz.com/threat-advisory/ics-multiple-johnson-controls-frick-controls-quantum-hd-vulnerabilities)
- [CVEFeed - CVE-2026-21657](https://cvefeed.io/vuln/detail/CVE-2026-21657)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4354