# CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (CWE-94)

> CVE-2026-21656 is a pre-authentication code injection flaw (CWE-94) in Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers, versions 10.22 and earlier (end of support). Insufficient validation of input in network-accessible parameters can let an unauthenticated attacker take unexpected actions that compromise the device; Johnson Controls directs customers to upgrade to Quantum HD Unity v12 or later.

- **Published:** 2026-11-02T20:01:43Z
- **Last reviewed:** 2026-11-02T20:01:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5091
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5091.png
- **ID:** TL-2026-5091
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** ICS_SCADA
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-21656

## Description

CVE-2026-21656 was reserved on 2026-01-02 by Johnson Controls (CNA 'jci'), published on 2026-02-27 and updated on 2026-03-06. It is one of six vulnerabilities in Frick Controls Quantum HD covered by CISA ICS Advisory ICSA-26-057-01 (released 2026-02-26) and Johnson Controls Product Security Advisory JCI-PSA-2026-05: CVE-2026-21654 (CWE-78 OS command injection), CVE-2026-21656, CVE-2026-21657 and CVE-2026-21658 (all CWE-94 code injection), CVE-2026-21659 (CWE-23 relative path traversal) and CVE-2026-21660 (plaintext/hardcoded credential storage). The vulnerabilities were discovered and reported by Noam Moshe of Claroty Research Team 82.

The flaw is described as insufficient validation of input in certain parameters that may permit unexpected actions which could impact the security of the device before authentication occurs. The CISA advisory states that successful exploitation of the vulnerability set can lead to pre-authentication remote code execution, information leak or denial of service. CISA rates CVE-2026-21656 at CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). NVD lists a CVSS v3.1 base score of 9.8 (C:H/I:H/A:H), and the CNA published a CVSS v4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). The weakness is CWE-94, and the NVD affected configuration is cpe:2.3:o:johnsoncontrols:frick_controls_quantum_hd_firmware (<= 10.22). The Claroty dashboard lists affected versions as 10.22 through 11; CISA, NVD and the CVE record state <= 10.22. The vendor treats these legacy platform versions as end of support.

The Quantum HD is an industrial refrigeration controller used for temperature control in cold storage, food processing and pharmaceutical manufacturing. CISA assigns it to the Food and Agriculture critical infrastructure sector, with worldwide deployment and vendor headquarters in Ireland. Secondary analysis by Burns & McDonnell says network reachability is the only precondition, that no user interaction is needed, and that exploitation could allow compressor parameter manipulation, filesystem access, persistent backdoor installation, lateral movement and refrigerant system control. The CISA advisory and the primary CVE record do not state those specific outcomes, so treat them as analyst assessment. No ports, protocols, endpoints or parameter names have been published.

Exploitation status: CISA reported no known public exploitation at the time of the advisory, and Aviatrix lists no public exploit. No IOCs, malware, threat actor or C2 infrastructure are associated with this CVE in any source. Remediation per the vendor is to upgrade to Quantum HD Unity version 12 or higher using the vendor software update procedure, then verify full compliance with the hardening guide and apply all recommended security configurations. Defenders should also keep these controllers off the internet, segment them behind industrial firewalls, restrict remote access through VPN with MFA, and monitor OT network traffic for anomalous requests.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1505 Server Software Component
- T1552.001 Unsecured Credentials: Credentials In Files

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Frick Controls Quantum HD Unauthenticated Shell Injection Syntax in HTTP Request (CVE-2026-21656)** (`TL-2026-5091-SPL-001`)

Detects unauthenticated HTTP requests to Frick Controls Quantum HD controllers (10.22 and earlier) whose URI or query string carries shell command-substitution or command-chaining syntax. This is the expected trigger shape for the pre-authentication code injection (CWE-94) in CVE-2026-21656 and its sibling CVE-2026-21654 (CWE-78). No exploit parameter names are published and no public exploit exists, so the logic is behaviour-first: injection syntax sent to a known controller with no HTTP authentication. Requires a quantum_hd_assets.csv lookup with a dest_ip column listing controller addresses.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1059.004
- **Data sources:** zeek:bro:http:json, cef_firewall:CommonSecurityLog, webserver_access_logs
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

```spl
index=zeek sourcetype="bro:http:json" earliest=-24h | rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip | search [| inputlookup quantum_hd_assets.csv | fields dest_ip] | eval decoded_uri=urldecode(urldecode(coalesce(uri,""))) | where isnull(username) OR username="" | where match(decoded_uri, "(?i)([$][[:punct:]]|[;|&][ ]*(sh|bash|ash|busybox|cat|wget|curl|tftp|nc|ncat|telnet|chmod|python|perl)([ ]|$)|[|][|]|&&|[<][?])") | stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods values(status_code) as status_codes values(decoded_uri) as uris values(user_agent) as user_agents by src_ip dest_ip | eval cve="CVE-2026-21656", product="Frick Controls Quantum HD" | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let assets = _GetWatchlist('QuantumHDAssets') | project IPAddress; CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationIP in (assets) | where isnotempty(RequestURL) | extend DecodedUrl = url_decode(url_decode(RequestURL)) | where DecodedUrl matches regex @'(?i)([$][[:punct:]]|[;|&][ ]*(sh|bash|ash|busybox|cat|wget|curl|tftp|nc|ncat|telnet|chmod|python|perl)([ ]|$)|[|][|]|&&|[<][?])' | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, DecodedUrl, RequestClientApplication, DeviceVendor, DeviceAction
```

### Sigma

```yaml
title: Quantum HD Web Request With Shell Command Injection Metacharacters (CVE-2026-21656)
id: 7c1f3a52-9b0e-4d6a-8f21-3e5a1c7b9d04
status: experimental
description: Detects HTTP requests carrying shell command-substitution or command-chaining syntax in the query string, the behaviour expected when exploiting pre-authentication code injection in Frick Controls Quantum HD 10.22 and earlier. Exploit parameters are unpublished so this matches generic injection syntax. Scope the log source to Quantum HD destination hosts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
  - https://nvd.nist.gov/vuln/detail/CVE-2026-21656
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
  - cve.2026-21656
logsource:
  category: webserver
detection:
  selection_query:
    cs-uri-query|contains:
      - '$('
      - '${'
      - '%24%28'
      - '%24%7B'
      - ';wget'
      - ';curl'
      - '%3Bwget'
      - '%3Bcurl'
      - '|sh'
      - '|bash'
      - '%7Csh'
      - '%7Cbash'
      - '&&wget'
      - '&&curl'
  condition: selection_query
falsepositives:
  - Authorised vulnerability scanners or penetration tests against OT assets
  - Applications that legitimately embed shell-like syntax in query parameters
level: high

```

**Known false positives:**

- Authorised vulnerability scans or penetration tests against the OT network
- Engineering tools or HMI clients that pass shell-like characters in legitimate parameters

**Tuning notes:** Populate quantum_hd_assets.csv (SPL) and the QuantumHDAssets watchlist (KQL) with controller IPs. Exclude approved scanner sources. Once exploit parameter names are published, narrow the regex to those parameters. The username check only works where HTTP basic auth is visible to Zeek; remove it if the controller uses form-based login.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Quantum HD Web Interface Probed by Non-Allowlisted Source (Pre-Authentication Reconnaissance) (locked: unlock with TL Creds)
- Quantum HD Path Traversal and Credential or Config File Retrieval via Web Interface (locked: unlock with TL Creds)
- Quantum HD Controller Connecting to Other OT or Admin Services (Lateral Movement) (locked: unlock with TL Creds)
- Quantum HD Web Request With Scripting-Language Code Injection Keywords (CWE-94, CVE-2026-21656) (locked: unlock with TL Creds)
- Quantum HD Web Server Process Spawning Shell or Download Utility (locked: unlock with TL Creds)
- Quantum HD Web Service Crash or Watchdog Event (Denial of Service After Exploitation Attempt) (locked: unlock with TL Creds)
- Quantum HD Script or Web Shell Upload and Success Response (Persistence After CVE-2026-21656) (locked: unlock with TL Creds)
- Quantum HD Controller Initiating Outbound Internet Connections (Reverse Shell or Tool Download) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21656](https://claroty.com/team82/disclosure-dashboard/cve-2026-21656)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls, Inc. Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD - CVE-2026-21656](https://nvd.nist.gov/vuln/detail/CVE-2026-21656)
- [CVE.org record CVE-2026-21656 (CNA: Johnson Controls)](https://cveawg.mitre.org/api/cve/CVE-2026-21656)
- [Johnson Controls Security Advisories (JCI-PSA-2026-05)](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Quantum HD Unity Software Update Procedure (vendor PDF)](https://frickcontrolsblob.file.core.windows.net/frickweb1/Quantum-HD-Unity/Quantum_HD_Unity_Software_Update_Procedure.pdf)
- [Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [Aviatrix Threat Research Center - Johnson Controls 2026 Unauthenticated Remote Code Execution](https://aviatrix.ai/threat-research-center/johnson-controls-2026-unauthenticated-remote-code-execution/)
- [CraftedSignal brief - Quantum HD vulnerabilities](https://feed.craftedsignal.io/briefs/2026-02-quantum-hd-vulns/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5091