CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (CWE-94)

Key facts for Frick Quantum HD CVE-2026-21656

Detection coverage for Frick Quantum HD CVE-2026-21656

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5091 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Frick Controls Quantum HD Unauthenticated Shell Injection Syntax in HTTP Request (CVE-2026-21656)

Detects unauthenticated HTTP requests to Frick Controls Quantum HD controllers (10.22 and earlier) whose URI or query string carries shell command-substitution or command-chaining syntax. This is the expected trigger shape for the pre-authentication code injection (CWE-94) in CVE-2026-21656 and its sibling CVE-2026-21654 (CWE-78). No exploit parameter names are published and no public exploit exists, so the logic is behaviour-first: injection syntax sent to a known controller with no HTTP authentication. Requires a quantum_hd_assets.csv lookup with a dest_ip column listing controller addresses.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T1059.004
• Data sources: zeek:bro:http:json, cef_firewall:CommonSecurityLog, webserver_access_logs
• Severity: critical
• Confidence: medium

Splunk SPL

index=zeek sourcetype="bro:http:json" earliest=-24h | rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip | search [| inputlookup quantum_hd_assets.csv | fields dest_ip] | eval decoded_uri=urldecode(urldecode(coalesce(uri,""))) | where isnull(username) OR username="" | where match(decoded_uri, "(?i)([$][[:punct:]]|[;|&][ ]*(sh|bash|ash|busybox|cat|wget|curl|tftp|nc|ncat|telnet|chmod|python|perl)([ ]|$)|[|][|]|&&|[<][?])") | stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods values(status_code) as status_codes values(decoded_uri) as uris values(user_agent) as user_agents by src_ip dest_ip | eval cve="CVE-2026-21656", product="Frick Controls Quantum HD" | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let assets = _GetWatchlist('QuantumHDAssets') | project IPAddress; CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationIP in (assets) | where isnotempty(RequestURL) | extend DecodedUrl = url_decode(url_decode(RequestURL)) | where DecodedUrl matches regex @'(?i)([$][[:punct:]]|[;|&][ ]*(sh|bash|ash|busybox|cat|wget|curl|tftp|nc|ncat|telnet|chmod|python|perl)([ ]|$)|[|][|]|&&|[<][?])' | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, DecodedUrl, RequestClientApplication, DeviceVendor, DeviceAction

Sigma

title: Quantum HD Web Request With Shell Command Injection Metacharacters (CVE-2026-21656)
id: 7c1f3a52-9b0e-4d6a-8f21-3e5a1c7b9d04
status: experimental
description: Detects HTTP requests carrying shell command-substitution or command-chaining syntax in the query string, the behaviour expected when exploiting pre-authentication code injection in Frick Controls Quantum HD 10.22 and earlier. Exploit parameters are unpublished so this matches generic injection syntax. Scope the log source to Quantum HD destination hosts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
  - https://nvd.nist.gov/vuln/detail/CVE-2026-21656
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
  - cve.2026-21656
logsource:
  category: webserver
detection:
  selection_query:
    cs-uri-query|contains:
      - '$('
      - '${'
      - '%24%28'
      - '%24%7B'
      - ';wget'
      - ';curl'
      - '%3Bwget'
      - '%3Bcurl'
      - '|sh'
      - '|bash'
      - '%7Csh'
      - '%7Cbash'
      - '&&wget'
      - '&&curl'
  condition: selection_query
falsepositives:
  - Authorised vulnerability scanners or penetration tests against OT assets
  - Applications that legitimately embed shell-like syntax in query parameters
level: high

Known false positives:

• Authorised vulnerability scans or penetration tests against the OT network
• Engineering tools or HMI clients that pass shell-like characters in legitimate parameters

Tuning notes: Populate quantum_hd_assets.csv (SPL) and the QuantumHDAssets watchlist (KQL) with controller IPs. Exclude approved scanner sources. Once exploit parameter names are published, narrow the regex to those parameters. The username check only works where HTTP basic auth is visible to Zeek; remove it if the controller uses form-based login.

• 🔒 Quantum HD Web Interface Probed by Non-Allowlisted Source (Pre-Authentication Reconnaissance) · unlock with TL Creds
• 🔒 Quantum HD Path Traversal and Credential or Config File Retrieval via Web Interface · unlock with TL Creds
• 🔒 Quantum HD Controller Connecting to Other OT or Admin Services (Lateral Movement) · unlock with TL Creds
• 🔒 Quantum HD Web Request With Scripting-Language Code Injection Keywords (CWE-94, CVE-2026-21656) · unlock with TL Creds
• 🔒 Quantum HD Web Server Process Spawning Shell or Download Utility · unlock with TL Creds
• 🔒 Quantum HD Web Service Crash or Watchdog Event (Denial of Service After Exploitation Attempt) · unlock with TL Creds
• 🔒 Quantum HD Script or Web Shell Upload and Success Response (Persistence After CVE-2026-21656) · unlock with TL Creds
• 🔒 Quantum HD Controller Initiating Outbound Internet Connections (Reverse Shell or Tool Download) · unlock with TL Creds

Indicators of compromise for Frick Quantum HD CVE-2026-21656

As of 2026-11-02, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5091.

How Frick Quantum HD CVE-2026-21656 works

CVE-2026-21656 was reserved on 2026-01-02 by Johnson Controls (CNA 'jci'), published on 2026-02-27 and updated on 2026-03-06. It is one of six vulnerabilities in Frick Controls Quantum HD covered by CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) and Johnson Controls Product Security Advisory JCI-PSA-2026-05: CVE-2026-21654 (CWE-78 OS command injection), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (all CWE-94 code injection), CVE-2026-21659 (CWE-23 relative path traversal) and CVE-2026-21660 (plaintext/hardcoded credential storage). The vulnerabilities were discovered and reported by Noam Moshe of Claroty Research Team 82.

The flaw is described as insufficient validation of input in certain parameters that may permit unexpected actions which could impact the security of the device before authentication occurs. The CISA advisory states that successful exploitation of the vulnerability set can lead to pre-authentication remote code execution, information leak or denial of service. CISA rates CVE-2026-21656 at CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). NVD lists a CVSS v3.1 base score of 9.8 (C:H/I:H/A:H), and the CNA published a CVSS v4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). The weakness is CWE-94, and the NVD affected configuration is cpe:2.3:o:johnsoncontrols:frick_controls_quantum_hd_firmware (<= 10.22). The Claroty dashboard lists affected versions as 10.22 through 11; CISA, NVD and the CVE record state <= 10.22. The vendor treats these legacy platform versions as end of support.

The Quantum HD is an industrial refrigeration controller used for temperature control in cold storage, food processing and pharmaceutical manufacturing. CISA assigns it to the Food and Agriculture critical infrastructure sector, with worldwide deployment and vendor headquarters in Ireland. Secondary analysis by Burns & McDonnell says network reachability is the only precondition, that no user interaction is needed, and that exploitation could allow compressor parameter manipulation, filesystem access, persistent backdoor installation, lateral movement and refrigerant system control. The CISA advisory and the primary CVE record do not state those specific outcomes, so treat them as analyst assessment. No ports, protocols, endpoints or parameter names have been published.

Exploitation status: CISA reported no known public exploitation at the time of the advisory, and Aviatrix lists no public exploit. No IOCs, malware, threat actor or C2 infrastructure are associated with this CVE in any source. Remediation per the vendor is to upgrade to Quantum HD Unity version 12 or higher using the vendor software update procedure, then verify full compliance with the hardening guide and apply all recommended security configurations. Defenders should also keep these controllers off the internet, segment them behind industrial firewalls, restrict remote access through VPN with MFA, and monitor OT network traffic for anomalous requests.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505 Server Software Component

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Remediation for Frick Quantum HD CVE-2026-21656

Patches

• Upgrade to Quantum HD Unity version 12 or higher per Johnson Controls Quantum_HD_Unity_Software_Update_Procedure.pdf and JCI-PSA-2026-05

Immediate actions

• Identify all Frick Controls Quantum HD controllers (10.22 and earlier) and audit for internet reachability
• Remove direct internet exposure and place controllers behind industrial firewalls, isolated from business networks
• Restrict remote access to VPN with multi-factor authentication
• Monitor OT network traffic for anomalous or unauthenticated requests to the controller web interface

Workarounds

• No vendor workaround published; versions 10.22 through 11 are end of support, so upgrade is the only vendor-recommended fix
• After upgrade, verify full compliance with the Quantum HD Unity hardening guide and apply all recommended security configurations

Longer-term hardening

• Migrate end-of-support Quantum HD controllers to Quantum HD Unity platform
• Deploy OT network monitoring and anomaly detection for refrigeration control systems
• Apply network segmentation and egress policy enforcement for OT zones

Affected and fixed versions

• Johnson Controls — Frick Controls Quantum HD
  Vulnerable versions: 10.22 and earlier (CISA/NVD); 10.22 through 11 (Claroty Team82)
  Fixed in: Quantum HD Unity 12 or higher

Timeline of Frick Quantum HD CVE-2026-21656

• 2026-01-02 CVE-2026-21656 reserved by Johnson Controls (CNA 'jci').
• 2026-02-26 CISA releases ICS Advisory ICSA-26-057-01 covering six locked-ioc-5 vulnerabilities (CVE-2026-21654, -21656, -21657, -21658, -21659, -21660), credited to Noam Moshe of Claroty Team82; Johnson Controls publishes advisory JCI-PSA-2026-05.
• 2026-02-27 Burns & McDonnell and Aviatrix publish analyses of the vulnerability set; Aviatrix notes no public exploit exists.
• 2026-02-27 CVE-2026-21656 published to CVE.org/NVD as CWE-94 code injection in locked-ioc-5 <= 10.22.
• 2026-03-02 NVD record last modified (per search index).
• 2026-03-06 CVE.org record for CVE-2026-21656 updated with CVSS v4.0 score of 8.8 and credits.

Sources cited for Frick Quantum HD CVE-2026-21656

• CISA ICS Advisory ICSA-26-057-01 - Johnson Controls, Inc. Frick Controls Quantum HD CISA · Government advisory · 2026-02-26
• NVD - CVE-2026-21656 NVD (NIST) · Advisory · 2026-02-27
• CVE.org record CVE-2026-21656 (CNA: Johnson Controls) MITRE · Advisory · 2026-02-27
• Claroty Team82 Disclosure Dashboard - CVE-2026-21656 claroty.com · Research
• Johnson Controls Security Advisories (JCI-PSA-2026-05) johnsoncontrols.com · Vendor report · 2026-02-26
• Quantum HD Unity Software Update Procedure (vendor PDF) frickcontrolsblob.file.core.windows.net · Vendor report
• Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution aviatrix.ai · Research · 2026-02-27
• Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD 1898advisories.burnsmcd.com · Blog · 2026-02-27
• CraftedSignal brief - Quantum HD vulnerabilities feed.craftedsignal.io · Blog

More in ics scada

• Second Wave of Attacks on European Supermarket Refrigeration Controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB) Forces Defrost Mode
• Threat actors targeting internet-exposed PLCs in US water/wastewater sector causing lockouts, disconnections and boil water notices (CISA alert 2026-07-30; Iranian-affiliated PLC campaign AA26-097A)
• CVE-2026-21654 - Johnson Controls Frick Controls Quantum HD Pre-Authentication OS Command Injection (ICSA-26-057-01)
• CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation)
• CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD Unauthenticated Local File Inclusion Leading to Remote Code Execution

Related coverage of this activity

• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD