Threat reportICS/SCADATL-2026-4365
CVE-2026-21654 - Johnson Controls Frick Controls Quantum HD Pre-Authentication OS Command Injection (ICSA-26-057-01)
CVE-2026-21654 (TL-2026-4365), also tracked as ICSA-26-057-01, is a critical-severity ICS/SCADA threat scored CVSS 9.8, first published 2026-10-24. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21654), maps to 5 MITRE ATT&CK techniques (T1005, T1059, T1078.001), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4365
- Threat ID
- TL-2026-4365
- Also known as
- ICSA-26-057-01, JCI-PSA-2026-05
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food-and-agriculture, food-production, beverage, dairy, cold-storage, industrial-refrigeration
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-21654 works
CVE-2026-21654 is a pre-authentication OS command injection (CWE-78) in the Johnson Controls Frick Controls Quantum HD industrial refrigeration controller, firmware 10.22 and prior. A remote, unauthenticated attacker with network reachability to the device interface can run operating-system commands. The affected versions are end-of-support, and the vendor directs customers to Quantum HD Unity v12 or higher.
CVE-2026-21654 affects the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller used in food and agriculture cold-chain environments. The CVE record describes it as an OS Command Injection weakness (CWE-78). Insufficient validation of input in certain parameters may permit unexpected actions that affect device security before authentication occurs. NVD and the CISA CVE record list affected firmware as 10.22 and prior. The Claroty Team82 disclosure dashboard states 10.22 through 11.
The flaw is one of six vulnerabilities disclosed together in CISA ICS Advisory ICSA-26-057-01 (vendor advisory JCI-PSA-2026-05). The related CVEs are CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection, CVSS 9.1), CVE-2026-21659 (CWE-23 path traversal, 7.5) and CVE-2026-21660 (CWE-798 hardcoded credentials, 6.2). The advisory reports the vulnerabilities were discovered by Noam Moshe of Claroty Team82. Per the Burns & McDonnell 1898 advisory, the Quantum HD interface need only be reachable on the network for an attacker to achieve operating-system-level code execution.
Scoring differs by source. CISA, the vendor CNA and Claroty give CVSS v3.1 9.1 (Critical). NVD lists CVSS v3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 score of 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N). The Aviatrix write-up lists 8.8, which looks like a v4-style score. This record uses the NVD v3.1 vector and score for internal consistency.
CISA states that no known public exploitation specifically targeting these vulnerabilities had been reported to CISA at the time of the advisory. The Aviatrix analysis says no public exploits exist. No PoC, malware, C2 infrastructure or network IOCs are published in any source reviewed. The IOC list below therefore holds product, advisory and behavioral indicators for asset inventory and hunting, not malicious infrastructure. The affected versions are legacy and end-of-support. Remediation is to upgrade to Quantum HD Unity v12 or higher, then comply with the hardening guide. Interim guidance is to isolate devices behind industrial firewalls, require VPN with MFA for remote access, monitor OT network traffic, and audit internet-exposed installations.
MITRE ATT&CK techniques used in TL-2026-4365
Collection
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application
Credential Access
Affected products and versions in CVE-2026-21654
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 and prior (Claroty lists 10.22 through 11)
Fixed in: Quantum HD Unity v12 or higher
Remediation for CVE-2026-21654
Patches
- Upgrade to Frick Controls Quantum HD Unity version 12 or higher (Johnson Controls advisory JCI-PSA-2026-05)
Immediate actions
- Audit and remove internet exposure of Frick Controls Quantum HD interfaces
- Isolate Quantum HD controllers behind industrial firewalls with network segmentation
- Require VPN with multi-factor authentication for any remote access to the controllers
- Monitor OT network and egress traffic from the controllers for anomalous activity
Workarounds
- No patch exists for legacy versions; rely on network isolation, firewalling and VPN+MFA until upgrade
Longer-term hardening
- Replace end-of-support Quantum HD 10.22-11 platforms with Quantum HD Unity v12 or higher
- Comply with the Quantum HD Unity hardening guide and apply recommended security configurations
- Deploy intrusion prevention and OT network monitoring for refrigeration and cold-chain control networks
CVEs associated with CVE-2026-21654
Weaknesses (CWE) in CVE-2026-21654
Timeline of CVE-2026-21654
- CISA states no known public exploitation specifically targeting these vulnerabilities has been reported at the time of the advisory.
- Vendor recommends upgrading to Quantum HD Unity v12 or higher; affected versions are legacy and end-of-support.
- CVE-2026-21654 is published in NVD as CWE-78 OS Command Injection, CVSS v3.1 9.8 and CVSS v4.0 8.8; the CNA and CISA advisory list 9.1.
- CISA publishes ICS Advisory ICSA-26-057-01 covering Frick Controls Quantum HD 10.22 and earlier; Johnson Controls advisory JCI-PSA-2026-05 provides mitigation.
- Noam Moshe of Claroty Team82 is credited with discovering the Quantum HD vulnerabilities, disclosed together as six CVEs including CVE-2026-21654.
- NVD record for CVE-2026-21654 last modified.
Sources cited for CVE-2026-21654
- Claroty Team82 Disclosure Dashboard - CVE-2026-21654
- CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD
- NVD - CVE-2026-21654
- Johnson Controls Product Security Advisories
- Quantum HD Unity Software Update Procedure (vendor)
- Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD
- Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution
- CVE Record - CVE-2026-21654 (MITRE CVE Services)
- NCSC-NL CSAF - CVE-2026-21654
Detection coverage for TL-2026-4365
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4365 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.