# CVE-2026-21658 — Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (CWE-94) in Industrial Refrigeration Controllers

> Insufficient validation of input in certain parameters of Johnson Controls Frick Controls Quantum HD (10.22 through 11) permits code injection and unexpected actions before authentication, with network reachability as the only requirement. Affected versions are legacy, end-of-support platforms; the vendor recommends upgrading to Quantum HD Unity version 12 or higher.

- **Published:** 2026-10-28T06:28:46Z
- **Last reviewed:** 2026-10-28T06:28:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4614
- **ID:** TL-2026-4614
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21658

## Description

CVE-2026-21658 is a pre-authentication code injection flaw (CWE-94, Improper Control of Generation of Code) in the Johnson Controls Frick Controls Quantum HD industrial refrigeration controller. The advisory describes it as insufficient validation of input in certain parameters that may permit unexpected actions, which could impact the security of the device before authentication occurs. Johnson Controls (the CNA) and CISA both rate it CVSS v3.1 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the CNA CVSS v4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.8. Some secondary aggregators list 8.8 (Aviatrix, v4-based) or 9.8; the CISA and CNA v3.1 value is used here.

The flaw was reported by Noam Moshe of Claroty Research Team 82 and disclosed through CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) together with Johnson Controls Product Security Advisory JCI-PSA-2026-05. The CVE was reserved on 2026-01-02 and published on 2026-02-27. It is one of a cluster of six Quantum HD vulnerabilities: CVE-2026-21654 (OS command injection, CWE-78, 9.1), CVE-2026-21656, -21657 and -21658 (code injection, CWE-94, 9.1), CVE-2026-21659 (relative path traversal, CWE-23, 7.5, enabling code execution) and CVE-2026-21660 (hardcoded/plaintext-stored credentials, 6.2). Secondary reporting (Burns & McDonnell) states that the flaws are reachable through the device web interface and URI-based access points via specially crafted requests, that network reachability is the only requirement, and that successful exploitation yields command execution on the controller operating system, with arbitrary filesystem reads/writes, manipulation of refrigeration control parameters and potential installation of persistent backdoors.

Quantum HD is deployed in industrial refrigeration in the Food and Agriculture critical infrastructure sector worldwide (food production, beverages, dairy, warehousing/cold storage). Per CISA, no known public exploitation specifically targeting these vulnerabilities had been reported at advisory release; Aviatrix likewise lists no public exploit for any of the six CVEs. No KEV listing, public PoC, or network IOCs (IPs, domains, hashes) were identified in the sources reviewed, so the IOC set below is composed of product, version, identifier and weakness indicators useful for asset inventory and exposure hunting rather than infrastructure indicators. Versions 10.22 through 11 are legacy platforms that have reached end of support; the fix is migration to Quantum HD Unity v12 or later, followed by applying the hardening guide.

Where migration is delayed, defenders should isolate controllers in dedicated OT segments behind industrial firewalls, gate remote access behind VPN with multi-factor authentication, audit internet-reachable installations, deploy OT network monitoring, and watch web-interface requests for code-injection patterns. The impact vector (I:H/A:H) implies an attacker could alter controller behavior or disrupt refrigeration operations; Aviatrix estimates a successful incident at roughly 7 days of downtime and about $500,000 in loss (an analyst estimate, not an observed incident).

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1082 System Information Discovery
- T1565 Data Manipulation
- T0814 Denial of Service

## Sources

- [Claroty Team82 Disclosure Dashboard — CVE-2026-21658](https://ja.claroty.com/team82/disclosure-dashboard/cve-2026-21658)
- [CISA ICS Advisory ICSA-26-057-01 — Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD — CVE-2026-21658](https://nvd.nist.gov/vuln/detail/CVE-2026-21658)
- [Lutra Security Field Guide — CVE-2026-21658](https://fieldguide.lutrasecurity.com/CVE-2026-21658)
- [Johnson Controls Security Advisories (JCI-PSA-2026-05)](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Burns & McDonnell 1898 Advisories — Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [Aviatrix Threat Research Center — Johnson Controls 2026 Unauthenticated Remote Code Execution](https://aviatrix.ai/threat-research-center/johnson-controls-2026-unauthenticated-remote-code-execution/)
- [CraftedSignal Brief — Quantum HD vulnerabilities](https://feed.craftedsignal.io/briefs/2026-02-quantum-hd-vulns/)
- [INCIBE-CERT — Múltiples vulnerabilidades en Frick Controls Quantum HD de Johnson Controls](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-frick-controls-quantum-hd-de-johnson-controls-inc)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4614