# CVE-2026-21654 - Johnson Controls Frick Controls Quantum HD Pre-Authentication OS Command Injection (ICSA-26-057-01)

> CVE-2026-21654 is a pre-authentication OS command injection (CWE-78) in the Johnson Controls Frick Controls Quantum HD industrial refrigeration controller, firmware 10.22 and prior. A remote, unauthenticated attacker with network reachability to the device interface can run operating-system commands. The affected versions are end-of-support, and the vendor directs customers to Quantum HD Unity v12 or higher.

- **Published:** 2026-10-24T09:58:05Z
- **Last reviewed:** 2026-10-24T09:58:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4365
- **ID:** TL-2026-4365
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21654

## Description

CVE-2026-21654 affects the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller used in food and agriculture cold-chain environments. The CVE record describes it as an OS Command Injection weakness (CWE-78). Insufficient validation of input in certain parameters may permit unexpected actions that affect device security before authentication occurs. NVD and the CISA CVE record list affected firmware as 10.22 and prior. The Claroty Team82 disclosure dashboard states 10.22 through 11.

The flaw is one of six vulnerabilities disclosed together in CISA ICS Advisory ICSA-26-057-01 (vendor advisory JCI-PSA-2026-05). The related CVEs are CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (CWE-94 code injection, CVSS 9.1), CVE-2026-21659 (CWE-23 path traversal, 7.5) and CVE-2026-21660 (CWE-798 hardcoded credentials, 6.2). The advisory reports the vulnerabilities were discovered by Noam Moshe of Claroty Team82. Per the Burns & McDonnell 1898 advisory, the Quantum HD interface need only be reachable on the network for an attacker to achieve operating-system-level code execution.

Scoring differs by source. CISA, the vendor CNA and Claroty give CVSS v3.1 9.1 (Critical). NVD lists CVSS v3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 score of 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N). The Aviatrix write-up lists 8.8, which looks like a v4-style score. This record uses the NVD v3.1 vector and score for internal consistency.

CISA states that no known public exploitation specifically targeting these vulnerabilities had been reported to CISA at the time of the advisory. The Aviatrix analysis says no public exploits exist. No PoC, malware, C2 infrastructure or network IOCs are published in any source reviewed. The IOC list below therefore holds product, advisory and behavioral indicators for asset inventory and hunting, not malicious infrastructure. The affected versions are legacy and end-of-support. Remediation is to upgrade to Quantum HD Unity v12 or higher, then comply with the hardening guide. Interim guidance is to isolate devices behind industrial firewalls, require VPN with MFA for remote access, monitor OT network traffic, and audit internet-exposed installations.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1078.001 Valid Accounts: Default Accounts
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21654](https://br.claroty.com/team82/disclosure-dashboard/cve-2026-21654)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD - CVE-2026-21654](https://nvd.nist.gov/vuln/detail/cve-2026-21654)
- [Johnson Controls Product Security Advisories](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Quantum HD Unity Software Update Procedure (vendor)](https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf)
- [Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution](https://aviatrix.ai/threat-research-center/johnson-controls-2026-unauthenticated-remote-code-execution/)
- [CVE Record - CVE-2026-21654 (MITRE CVE Services)](https://cveawg.mitre.org/api/cve/CVE-2026-21654)
- [NCSC-NL CSAF - CVE-2026-21654](https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21654.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4365