CVE-2026-21659 — Johnson Controls Frick Controls Quantum HD unauthenticated path traversal / local file inclusion leading to arbitrary code execution

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5918 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-21659 Quantum HD Path Traversal / LFI Attempt — HTTP URI Traversal Sequences

Detects HTTP requests containing relative path traversal sequences (../, ..%2f, %2e%2e%2f, double-encoded and overlong-UTF8 variants) in the URI. This is the generic exploitation pivot for CVE-2026-21659 (CWE-23/CWE-22 unauthenticated local file inclusion in Frick Controls Quantum HD 10.22 and earlier, ICSA-26-057-01, JCI-PSA-2026-05). The exact vulnerable endpoint is not published, so the rule is behaviour-first: scope it to Quantum HD controller addresses where known.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T0819, T1083
• Data sources: zeek_http, web_proxy_waf, firewall_cef
• Severity: critical
• Confidence: medium

Splunk SPL

index=zeek sourcetype="bro:http:json" earliest=-24h
| regex uri="(?i)(\.\./|\.\.\x5c|%2e%2e(%2f|%5c|/)|%252e%252e|\.\.%2f|\.\.%5c|%c0%ae%c0%ae)"
| stats count AS requests dc(uri) AS distinct_uris values(uri) AS sample_uris values(status_code) AS http_status values(method) AS methods min(_time) AS first_seen max(_time) AS last_seen BY id.orig_h id.resp_h user_agent
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| rename id.orig_h AS src_ip, id.resp_h AS dest_ip
| sort - requests
| table first_seen last_seen src_ip dest_ip methods http_status requests distinct_uris sample_uris user_agent

Microsoft KQL

// CVE-2026-21659 Quantum HD path traversal / LFI attempt (T1190)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| where RequestURL matches regex @"(?i)(\.\./|\.\.\\|%2e%2e(%2f|%5c|/)|%252e%252e|\.\.%2f|\.\.%5c|%c0%ae%c0%ae)"
| summarize Requests = count(), DistinctUrls = dcount(RequestURL), SampleUrls = make_set(RequestURL, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DeviceVendor, DeviceProduct
| project FirstSeen, LastSeen, SourceIP, DestinationIP, DeviceVendor, DeviceProduct, Requests, DistinctUrls, SampleUrls
| order by Requests desc

Sigma

title: CVE-2026-21659 Quantum HD Path Traversal Sequence in Web Request
id: 5b0f7a3e-1c42-4d57-9a10-6e2a8c4d1001
status: experimental
description: Detects relative path traversal sequences in web request URIs, the generic exploitation pivot for CVE-2026-21659 (Frick Controls Quantum HD unauthenticated LFI, CWE-23/CWE-22).
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://nvd.nist.gov/vuln/detail/cve-2026-21659
    - https://claroty.com/team82/disclosure-dashboard/cve-2026-21659
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.21659
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - '../'
            - '..\'
            - '..%2f'
            - '%2e%2e%2f'
            - '%2e%2e/'
            - '..%5c'
            - '%2e%2e%5c'
            - '%252e%252e'
            - '%c0%ae%c0%ae'
    condition: selection
falsepositives:
    - Legitimate applications that pass relative paths in query parameters
    - Vulnerability scanners run by the security team
level: high

Known false positives:

• Authorized vulnerability scanners or penetration tests probing for traversal
• Web applications legitimately passing relative paths such as ../ in query strings

Tuning notes: Scope to Quantum HD controller addresses (id.resp_h) from the asset inventory and exclude approved scanner source IPs. Add a status_code=200 filter to prioritise successful inclusion. Review sibling advisory CVEs (CVE-2026-21654/21656/21657/21658) when alerts fire on the same host.

• 🔒 CVE-2026-21659 Quantum HD LFI — Traversal Targeting Sensitive Local Files · unlock with TL Creds
• 🔒 Quantum HD Post-Exploitation — Download Utility Execution on Controller (Ingress Tool Transfer) · unlock with TL Creds
• 🔒 Quantum HD Impact Staging — OT Protocol Writes to Controller from Unapproved Host · unlock with TL Creds
• 🔒 CVE-2026-21659 Quantum HD LFI Escalation to Code Execution — Traversal Including Scripts or Log Files · unlock with TL Creds
• 🔒 Quantum HD Post-Exploitation — Persistence File Modification on Controller · unlock with TL Creds
• 🔒 Quantum HD Lateral Movement — Controller Initiating Admin-Protocol Connections to Other Hosts · unlock with TL Creds
• 🔒 Quantum HD Post-Exploitation — Web Service Spawning Shell or Interpreter · unlock with TL Creds
• 🔒 Quantum HD C2 — New Outbound Internet Connections from Controller IPs · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5918.

Sample indicators (1 of 9)

• Domain: frickcontrolsblob[.]file[.]core[.]windows[.]net

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

Technical analysis

CVE-2026-21659 affects Frick Controls Quantum HD, a Johnson Controls controller used for industrial refrigeration in food and agriculture, cold storage and similar environments. It was reported to CISA by Noam Moshe of Claroty Team82 and disclosed on 2026-02-26 in CISA ICS advisory ICSA-26-057-01, together with five sibling flaws: CVE-2026-21654 (CWE-78 OS command injection, CVSS 9.1), CVE-2026-21656, -21657 and -21658 (CWE-94 code injection, CVSS 9.1 each) and CVE-2026-21660 (CWE-256 plaintext password storage, CVSS 6.2; described by CISA as hardcoded credentials and by Burns & McDonnell as CWE-798 credentials embedded in firmware). Johnson Controls tracks the issues in Product Security Advisory JCI-PSA-2026-05.

The NVD record describes CVE-2026-21659 as 'Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability' that lets an unauthenticated attacker run arbitrary code and fully compromise the device. The weakness is classified CWE-23 (Relative Path Traversal) by Johnson Controls as CNA and CWE-22 by NVD. Burns & McDonnell 1898 & Co. describes the flaw as a relative path traversal in the web application directory scope that can yield file access or code execution. Because the flaw is reachable over the network with no privileges and no user interaction, any controller whose service is exposed to an untrusted network is at risk. CISA's SSVC assessment (as recorded in NVD) is Exploitation: none, Automatable: yes, Technical Impact: total.

Severity scoring differs by source. CISA lists CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), a vector that only reflects confidentiality impact, and CISA itself notes the description and vector do not match. Claroty also lists 7.5. NVD (primary) lists 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and Johnson Controls as CNA lists CVSS 4.0 8.7 HIGH (VC:H only). The code-execution description is consistent with the NVD 9.8 vector, so this record uses the NVD score; defenders should treat the 7.5 figure as understating the impact.

Operational impact described by 1898 & Co. for the advisory's Quantum HD flaws includes arbitrary OS command execution on the controller, filesystem reads and writes, manipulation of refrigeration setpoints, safety limits and operating parameters, persistent backdoors, and pivoting into OT or IT networks, with consequences such as compressor damage, refrigerant release, product spoilage and loss of process safety, plus regulatory exposure. Commands are likely to run under a root-equivalent embedded account (stated as 'likely'). These impacts are drawn from the third-party analysis of the whole advisory, not a published CVE-2026-21659 exploit.

Affected versions are Quantum HD 10.22 and earlier (NVD CPE cpe:2.3:o:johnsoncontrols:frick_controls_quantum_hd_firmware, up to and including 10.22). Johnson Controls states that versions 10.22 through 11 are legacy platforms that have reached end of support and recommends upgrading to Quantum HD Unity version 12 or higher, then verifying full compliance with the hardening guide and applying all recommended security configurations. CISA reports no known public exploitation targeting these vulnerabilities, and the reviewed sources describe no public PoC and no CISA KEV listing. The sources do not publish the vulnerable endpoint, port, request format or payload, so no exploit-chain, malware or C2 details can be given. No attacker infrastructure is known, so there are no network IOCs to check against BeaconBeagle.

MITRE ATT&CK techniques by tactic:

Initial Access

T0819 Exploit Public-Facing Application; T1190 Exploit Public-Facing Application

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter

Remediation

Patches

• Upgrade to Frick Controls Quantum HD Unity version 12 or higher following the vendor Quantum HD Unity Software Update Procedure (see JCI-PSA-2026-05)

Immediate actions

• Remove Quantum HD controllers from direct internet exposure and restrict access to trusted management hosts
• Place control system networks behind firewalls and isolate them from business networks
• Use an up-to-date VPN (with strong MFA) for any required remote access
• Identify internet-reachable Quantum HD controllers, isolate them first, and log access attempts during the unpatched window
• Monitor network traffic to Quantum HD web and management services for path traversal sequences such as ../ and encoded variants, anomalous HTTP traffic, unexpected command execution and new outbound connections from controller IPs

Workarounds

• No vendor workaround is documented; minimize network exposure and segment the controller as described in JCI-PSA-2026-05 and the CISA advisory

Longer-term hardening

• Replace end-of-support Quantum HD 10.22 through 11 platforms with Quantum HD Unity version 12 or higher
• After upgrading, verify full compliance with the vendor hardening guide and apply all recommended security configurations
• After upgrading, validate that hardcoded credentials and injectable parameters are remediated in the deployed configuration
• Perform impact analysis and risk assessment before deploying defensive measures, per CISA ICS guidance

Affected and fixed versions

• Johnson Controls — Frick Controls Quantum HD
  Vulnerable versions: 10.22 and earlier; 10.22 through 11 (end of support)
  Fixed in: Quantum HD Unity 12 or higher

Timeline

• 2026-02-01 Per Burns & McDonnell 1898 & Co., the vendor remediation (Quantum HD Unity firmware version 12 or later) has been available since February 2026; exact day not stated.
• 2026-02-26 CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to CISA at the time of publication.
• 2026-02-26 Noam Moshe of Claroty Team82 is credited with reporting the vulnerabilities to CISA; Johnson Controls issues Product Security Advisory JCI-PSA-2026-05 with mitigation steps.
• 2026-02-26 CISA publishes ICS advisory ICSA-26-057-01 (Revision 1, initial release) covering Frick Controls Quantum HD 10.22 and earlier and six CVEs including CVE-2026-21659 (CVSS 7.5 in the advisory).
• 2026-02-27 CVE-2026-21659 is published in NVD, described as an LFI allowing unauthenticated arbitrary code execution; Johnson Controls (CNA) supplies CWE-23 and CVSS 4.0 8.7.
• 2026-03-06 Burns & McDonnell 1898 & Co. publishes an advisory analyzing the Quantum HD flaws, describing impacts including OS command execution, setpoint manipulation, persistence and IT/OT pivoting, and recommending isolation, VPN with MFA and upgrade to Unity 12.
• 2026-06-17 NVD record last modified with status Analyzed, scoring CVSS 3.1 9.8 CRITICAL (CWE-22), recording CISA SSVC (Exploitation none, Automatable yes, Technical Impact total) and listing CPE versions up to and including 10.22 as vulnerable.

Sources cited

• CISA ICS Advisory ICSA-26-057-01 — Johnson Controls Frick Controls Quantum HD CISA · Government advisory · 2026-02-26
• Claroty Team82 Disclosure Dashboard — CVE-2026-21659 claroty.com · Advisory
• NVD — CVE-2026-21659 NVD (NIST) · Advisory · 2026-02-27
• MITRE CVE Record — CVE-2026-21659 MITRE · Advisory · 2026-02-27
• INCIBE-CERT — Multiple vulnerabilities in Frick Controls Quantum HD incibe.es · Advisory
• Claroty Team82 Disclosure Dashboard — CVE-2026-21654 (sibling) blog.claroty.com · Advisory
• Johnson Controls Security Advisories (JCI-PSA-2026-05) johnsoncontrols.com · Vendor report · 2026-02-26
• Burns & McDonnell 1898 & Co. Advisory — Frick Controls Quantum HD critical pre-authentication vulnerabilities 1898advisories.burnsmcd.com · Research · 2026-03-06

More in ics scada

• CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (<=1.12.1) Enabling Authenticated RCE via Crafted LCD State
• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Code Injection via Insufficient Input Validation (Pre-Authentication)
• CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Insufficient Input Validation (Pre-Authentication Code Injection)
• CVE-2026-21658: Pre-Authentication Input Validation / Code Injection Flaw in Johnson Controls Frick Controls Quantum HD (10.22 and earlier, legacy through 11)
• CVE-2025-13901 - Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404)

Related coverage of this activity

• CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD

Other reports on CVE-2026-21659

• CVE-2026-21654 - Johnson Controls Frick Controls Quantum HD Pre-Authentication OS Command Injection (ICSA-26-057-01)