Threat reportVulnerabilityTL-2026-4614
CVE-2026-21658 — Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (CWE-94) in Industrial Refrigeration Controllers
CVE-2026-21658 (TL-2026-4614), also tracked as ICSA-26-057-01, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-10-28. It has no confirmed attribution, affects Johnson Controls Frick Controls Quantum HD, references 1 CVE (CVE-2026-21658), maps to 7 MITRE ATT&CK techniques (T0814, T1059, T1059.004), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4614
- Threat ID
- TL-2026-4614
- Also known as
- ICSA-26-057-01, JCI-PSA-2026-05
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- food and agriculture, cold storage, food processing, industrial refrigeration, dairy, beverages, warehousing
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 7
How CVE-2026-21658 works
Insufficient validation of input in certain parameters of Johnson Controls Frick Controls Quantum HD (10.22 through 11) permits code injection and unexpected actions before authentication, with network reachability as the only requirement. Affected versions are legacy, end-of-support platforms; the vendor recommends upgrading to Quantum HD Unity version 12 or higher.
CVE-2026-21658 is a pre-authentication code injection flaw (CWE-94, Improper Control of Generation of Code) in the Johnson Controls Frick Controls Quantum HD industrial refrigeration controller. The advisory describes it as insufficient validation of input in certain parameters that may permit unexpected actions, which could impact the security of the device before authentication occurs. Johnson Controls (the CNA) and CISA both rate it CVSS v3.1 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the CNA CVSS v4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.8. Some secondary aggregators list 8.8 (Aviatrix, v4-based) or 9.8; the CISA and CNA v3.1 value is used here.
The flaw was reported by Noam Moshe of Claroty Research Team 82 and disclosed through CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) together with Johnson Controls Product Security Advisory JCI-PSA-2026-05. The CVE was reserved on 2026-01-02 and published on 2026-02-27. It is one of a cluster of six Quantum HD vulnerabilities: CVE-2026-21654 (OS command injection, CWE-78, 9.1), CVE-2026-21656, -21657 and -21658 (code injection, CWE-94, 9.1), CVE-2026-21659 (relative path traversal, CWE-23, 7.5, enabling code execution) and CVE-2026-21660 (hardcoded/plaintext-stored credentials, 6.2). Secondary reporting (Burns & McDonnell) states that the flaws are reachable through the device web interface and URI-based access points via specially crafted requests, that network reachability is the only requirement, and that successful exploitation yields command execution on the controller operating system, with arbitrary filesystem reads/writes, manipulation of refrigeration control parameters and potential installation of persistent backdoors.
Quantum HD is deployed in industrial refrigeration in the Food and Agriculture critical infrastructure sector worldwide (food production, beverages, dairy, warehousing/cold storage). Per CISA, no known public exploitation specifically targeting these vulnerabilities had been reported at advisory release; Aviatrix likewise lists no public exploit for any of the six CVEs. No KEV listing, public PoC, or network IOCs (IPs, domains, hashes) were identified in the sources reviewed, so the IOC set below is composed of product, version, identifier and weakness indicators useful for asset inventory and exposure hunting rather than infrastructure indicators. Versions 10.22 through 11 are legacy platforms that have reached end of support; the fix is migration to Quantum HD Unity v12 or later, followed by applying the hardening guide.
Where migration is delayed, defenders should isolate controllers in dedicated OT segments behind industrial firewalls, gate remote access behind VPN with multi-factor authentication, audit internet-reachable installations, deploy OT network monitoring, and watch web-interface requests for code-injection patterns. The impact vector (I:H/A:H) implies an attacker could alter controller behavior or disrupt refrigeration operations; Aviatrix estimates a successful incident at roughly 7 days of downtime and about $500,000 in loss (an analyst estimate, not an observed incident).
MITRE ATT&CK techniques used in TL-2026-4614
Inhibit Response Function
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Impact
Reconnaissance
Affected products and versions in CVE-2026-21658
- Johnson Controls — Frick Controls Quantum HD
Vulnerable versions: 10.22 through 11 (legacy, end of support); 10.22 and earlier per CISA
Fixed in: Quantum HD Unity version 12 or higher
Remediation for CVE-2026-21658
Patches
- Upgrade to Quantum HD Unity version 12 or higher using the vendor Quantum HD Unity Software Update Procedure (JCI-PSA-2026-05)
Immediate actions
- Isolate Quantum HD controllers in dedicated OT network segments behind industrial firewalls; block internet exposure
- Restrict remote access to VPN-gated paths with multi-factor authentication until upgrade is complete
- Audit for internet-reachable Quantum HD installations and prioritize their isolation
- Monitor web interface requests to Quantum HD devices for code-injection patterns and abnormal URI strings
- Deploy OT network monitoring for anomalous traffic to and from controllers
Workarounds
- No vendor workaround documented; use network isolation and access control until upgrade
Longer-term hardening
- Retire legacy/end-of-support Quantum HD 10.22-11 platforms
- Apply the Johnson Controls hardening guide and all recommended security configurations after upgrade
CVEs associated with CVE-2026-21658
Weaknesses (CWE) in CVE-2026-21658
Timeline of CVE-2026-21658
- CVE-2026-21658 reserved by Johnson Controls (CNA)
- CraftedSignal publishes a threat brief on the Quantum HD vulnerability cluster describing network-based pre-authentication exploitation via crafted requests
- CISA releases ICS advisory ICSA-26-057-01 covering six Quantum HD vulnerabilities, crediting Noam Moshe of Claroty Team82; Johnson Controls publishes JCI-PSA-2026-05; no known public exploitation reported to CISA
- Aviatrix Threat Research Center publishes analysis of the Quantum HD cluster, listing no public exploit and estimating about 7 days downtime and $500,000 loss for a successful attack
- Vendor fix and remediation path: upgrade to Quantum HD Unity version 12 or higher and apply the hardening guide
- CVE-2026-21658 published (CWE-94, CVSS v3.1 9.1, CVSS v4.0 8.8) and disclosed by Claroty Team82; affected versions 10.22 through 11 are end-of-support
- Burns & McDonnell publishes advisory analysis noting network reachability alone suffices for code execution on the controller; no public exploitation reported
Sources cited for CVE-2026-21658
- Claroty Team82 Disclosure Dashboard — CVE-2026-21658
- CISA ICS Advisory ICSA-26-057-01 — Johnson Controls Frick Controls Quantum HD
- NVD — CVE-2026-21658
- Lutra Security Field Guide — CVE-2026-21658
- Johnson Controls Security Advisories (JCI-PSA-2026-05)
- Burns & McDonnell 1898 Advisories — Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD
- Aviatrix Threat Research Center — Johnson Controls 2026 Unauthenticated Remote Code Execution
- CraftedSignal Brief — Quantum HD vulnerabilities
- INCIBE-CERT — Múltiples vulnerabilidades en Frick Controls Quantum HD de Johnson Controls
Detection coverage for TL-2026-4614
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4614 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.