# CVE-2026-21659 — Johnson Controls Frick Controls Quantum HD unauthenticated path traversal / local file inclusion leading to arbitrary code execution

> CVE-2026-21659 is an unauthenticated local file inclusion / relative path traversal flaw in Johnson Controls Frick Controls Quantum HD industrial refrigeration controllers (10.22 and earlier; versions 10.22 through 11 are end-of-support). Claroty, CISA and NVD describe unauthenticated arbitrary code execution and full device compromise; no public exploitation or PoC has been reported.

- **Published:** 2026-11-13T02:38:44Z
- **Last reviewed:** 2026-11-13T02:38:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5918
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5918.png
- **ID:** TL-2026-5918
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (1 shown free below)
- **CVEs:** CVE-2026-21659, CVE-2026-21654

## Description

CVE-2026-21659 affects Frick Controls Quantum HD, a Johnson Controls controller used for industrial refrigeration in food and agriculture, cold storage and similar environments. It was reported to CISA by Noam Moshe of Claroty Team82 and disclosed on 2026-02-26 in CISA ICS advisory ICSA-26-057-01, together with five sibling flaws: CVE-2026-21654 (CWE-78 OS command injection, CVSS 9.1), CVE-2026-21656, -21657 and -21658 (CWE-94 code injection, CVSS 9.1 each) and CVE-2026-21660 (CWE-256 plaintext password storage, CVSS 6.2; described by CISA as hardcoded credentials and by Burns & McDonnell as CWE-798 credentials embedded in firmware). Johnson Controls tracks the issues in Product Security Advisory JCI-PSA-2026-05.

The NVD record describes CVE-2026-21659 as 'Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability' that lets an unauthenticated attacker run arbitrary code and fully compromise the device. The weakness is classified CWE-23 (Relative Path Traversal) by Johnson Controls as CNA and CWE-22 by NVD. Burns & McDonnell 1898 & Co. describes the flaw as a relative path traversal in the web application directory scope that can yield file access or code execution. Because the flaw is reachable over the network with no privileges and no user interaction, any controller whose service is exposed to an untrusted network is at risk. CISA's SSVC assessment (as recorded in NVD) is Exploitation: none, Automatable: yes, Technical Impact: total.

Severity scoring differs by source. CISA lists CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), a vector that only reflects confidentiality impact, and CISA itself notes the description and vector do not match. Claroty also lists 7.5. NVD (primary) lists 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and Johnson Controls as CNA lists CVSS 4.0 8.7 HIGH (VC:H only). The code-execution description is consistent with the NVD 9.8 vector, so this record uses the NVD score; defenders should treat the 7.5 figure as understating the impact.

Operational impact described by 1898 & Co. for the advisory's Quantum HD flaws includes arbitrary OS command execution on the controller, filesystem reads and writes, manipulation of refrigeration setpoints, safety limits and operating parameters, persistent backdoors, and pivoting into OT or IT networks, with consequences such as compressor damage, refrigerant release, product spoilage and loss of process safety, plus regulatory exposure. Commands are likely to run under a root-equivalent embedded account (stated as 'likely'). These impacts are drawn from the third-party analysis of the whole advisory, not a published CVE-2026-21659 exploit.

Affected versions are Quantum HD 10.22 and earlier (NVD CPE cpe:2.3:o:johnsoncontrols:frick_controls_quantum_hd_firmware, up to and including 10.22). Johnson Controls states that versions 10.22 through 11 are legacy platforms that have reached end of support and recommends upgrading to Quantum HD Unity version 12 or higher, then verifying full compliance with the hardening guide and applying all recommended security configurations. CISA reports no known public exploitation targeting these vulnerabilities, and the reviewed sources describe no public PoC and no CISA KEV listing. The sources do not publish the vulnerable endpoint, port, request format or payload, so no exploit-chain, malware or C2 details can be given. No attacker infrastructure is known, so there are no network IOCs to check against BeaconBeagle.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1005 Data from Local System
- T0819 Exploit Public-Facing Application

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-21659 Quantum HD Path Traversal / LFI Attempt — HTTP URI Traversal Sequences** (`TL-2026-5918-SPL-001`)

Detects HTTP requests containing relative path traversal sequences (../, ..%2f, %2e%2e%2f, double-encoded and overlong-UTF8 variants) in the URI. This is the generic exploitation pivot for CVE-2026-21659 (CWE-23/CWE-22 unauthenticated local file inclusion in Frick Controls Quantum HD 10.22 and earlier, ICSA-26-057-01, JCI-PSA-2026-05). The exact vulnerable endpoint is not published, so the rule is behaviour-first: scope it to Quantum HD controller addresses where known.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T0819, T1083
- **Data sources:** zeek_http, web_proxy_waf, firewall_cef
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

```spl
index=zeek sourcetype="bro:http:json" earliest=-24h
| regex uri="(?i)(\.\./|\.\.\x5c|%2e%2e(%2f|%5c|/)|%252e%252e|\.\.%2f|\.\.%5c|%c0%ae%c0%ae)"
| stats count AS requests dc(uri) AS distinct_uris values(uri) AS sample_uris values(status_code) AS http_status values(method) AS methods min(_time) AS first_seen max(_time) AS last_seen BY id.orig_h id.resp_h user_agent
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| rename id.orig_h AS src_ip, id.resp_h AS dest_ip
| sort - requests
| table first_seen last_seen src_ip dest_ip methods http_status requests distinct_uris sample_uris user_agent
```

### Microsoft KQL

```kql
// CVE-2026-21659 Quantum HD path traversal / LFI attempt (T1190)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| where RequestURL matches regex @"(?i)(\.\./|\.\.\\|%2e%2e(%2f|%5c|/)|%252e%252e|\.\.%2f|\.\.%5c|%c0%ae%c0%ae)"
| summarize Requests = count(), DistinctUrls = dcount(RequestURL), SampleUrls = make_set(RequestURL, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DeviceVendor, DeviceProduct
| project FirstSeen, LastSeen, SourceIP, DestinationIP, DeviceVendor, DeviceProduct, Requests, DistinctUrls, SampleUrls
| order by Requests desc
```

### Sigma

```yaml
title: CVE-2026-21659 Quantum HD Path Traversal Sequence in Web Request
id: 5b0f7a3e-1c42-4d57-9a10-6e2a8c4d1001
status: experimental
description: Detects relative path traversal sequences in web request URIs, the generic exploitation pivot for CVE-2026-21659 (Frick Controls Quantum HD unauthenticated LFI, CWE-23/CWE-22).
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://nvd.nist.gov/vuln/detail/cve-2026-21659
    - https://claroty.com/team82/disclosure-dashboard/cve-2026-21659
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.21659
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - '../'
            - '..\'
            - '..%2f'
            - '%2e%2e%2f'
            - '%2e%2e/'
            - '..%5c'
            - '%2e%2e%5c'
            - '%252e%252e'
            - '%c0%ae%c0%ae'
    condition: selection
falsepositives:
    - Legitimate applications that pass relative paths in query parameters
    - Vulnerability scanners run by the security team
level: high

```

**Known false positives:**

- Authorized vulnerability scanners or penetration tests probing for traversal
- Web applications legitimately passing relative paths such as ../ in query strings

**Tuning notes:** Scope to Quantum HD controller addresses (id.resp_h) from the asset inventory and exclude approved scanner source IPs. Add a status_code=200 filter to prioritise successful inclusion. Review sibling advisory CVEs (CVE-2026-21654/21656/21657/21658) when alerts fire on the same host.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-21659 Quantum HD LFI — Traversal Targeting Sensitive Local Files (locked: unlock with TL Creds)
- Quantum HD Post-Exploitation — Download Utility Execution on Controller (Ingress Tool Transfer) (locked: unlock with TL Creds)
- Quantum HD Impact Staging — OT Protocol Writes to Controller from Unapproved Host (locked: unlock with TL Creds)
- CVE-2026-21659 Quantum HD LFI Escalation to Code Execution — Traversal Including Scripts or Log Files (locked: unlock with TL Creds)
- Quantum HD Post-Exploitation — Persistence File Modification on Controller (locked: unlock with TL Creds)
- Quantum HD Lateral Movement — Controller Initiating Admin-Protocol Connections to Other Hosts (locked: unlock with TL Creds)
- Quantum HD Post-Exploitation — Web Service Spawning Shell or Interpreter (locked: unlock with TL Creds)
- Quantum HD C2 — New Outbound Internet Connections from Controller IPs (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 9)

Defanged, TLP:CLEAR.

- Domain: `frickcontrolsblob[.]file[.]core[.]windows[.]net`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CISA ICS Advisory ICSA-26-057-01 — Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [Claroty Team82 Disclosure Dashboard — CVE-2026-21659](https://claroty.com/team82/disclosure-dashboard/cve-2026-21659)
- [NVD — CVE-2026-21659](https://nvd.nist.gov/vuln/detail/cve-2026-21659)
- [Johnson Controls Security Advisories (JCI-PSA-2026-05)](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [MITRE CVE Record — CVE-2026-21659](https://cveawg.mitre.org/api/cve/CVE-2026-21659)
- [Burns & McDonnell 1898 & Co. Advisory — Frick Controls Quantum HD critical pre-authentication vulnerabilities](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [INCIBE-CERT — Multiple vulnerabilities in Frick Controls Quantum HD](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-frick-controls-quantum-hd-de-johnson-controls-inc)
- [Claroty Team82 Disclosure Dashboard — CVE-2026-21654 (sibling)](https://blog.claroty.com/team82/disclosure-dashboard/cve-2026-21654)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5918