Skip to navigation

Threat reportICS/SCADATL-2026-5924

CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Code Injection via Insufficient Input Validation (Pre-Authentication)

criticalMONITORING

CVE-2026-21656 is a critical code-injection flaw (CWE-94) in Johnson Controls Frick Controls Quantum HD firmware 10.22 and earlier, caused by insufficient validation of input in certain parameters and reachable before authentication. Disclosed by Claroty Team82 and published by CISA as ICSA-26-057-01; no public exploitation has been reported.

Key facts

IdentifiersTL-2026-5924, CVE-2026-21656
Also known asICSA-26-057-01, JCI-PSA-2026-05
SeverityCRITICAL
CVSS9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSSCVE-2026-21656: 0.4% (38.8th percentile)
Affected productsJohnson Controls Frick Controls Quantum HD
Weaknesses (CWE)CWE-94
MITRE ATT&CK techniquesT0866 Exploitation of Remote Services, T1005 Data from Local System, T1021 Remote Services, T1059 Command and Scripting Interpreter, T1059.004 Unix Shell, T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1552.001 Credentials In Files, T1595.002 Vulnerability Scanning
MotivationUNKNOWN
Target sectorsfood-and-agriculture, industrial-refrigeration, industrial
Target regionsWorldwide
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5924 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Quantum HD Config/Credential File Retrieval - Post-Exploitation

SPL search for HTTP 200 responses serving configuration, backup, password or credential files from a Quantum HD controller to hosts outside the known engineering set. Covers analyst-assessed post-exploitation of CVE-2026-21656 (filesystem reads, credential harvesting and reuse of recovered accounts). These behaviours are assessed, not observed in the wild.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1005, T1083, T1552.001, T1078
  • Data sources: zeek_http, ics_network_monitoring
  • Severity: high
  • Confidence: medium

Splunk SPL

index=zeek sourcetype="bro:http:json" earliest=-24h [| inputlookup quantum_hd_controllers.csv | rename ip AS "id.resp_h" | fields "id.resp_h"] NOT [| inputlookup quantum_hd_admin_hosts.csv | rename ip AS "id.orig_h" | fields "id.orig_h"]
```comment: post-exploitation file and credential harvesting from a Quantum HD controller - config, backup or password files served with HTTP 200 to a non-admin host```
| eval uri_dec=urldecode(uri)
| where status_code=200 AND match(uri_dec, "(?i)(/etc/(passwd|shadow)|\.(cfg|conf|ini|db|bak)\b|backup|passwd|password|credential)")
| stats count AS hits sum(response_body_len) AS bytes_returned dc(uri_dec) AS distinct_files values(uri_dec) AS files values(username) AS usernames BY "id.orig_h" "id.resp_h"
| sort - bytes_returned

Microsoft KQL

let Controllers = _GetWatchlist('QuantumHD_Controllers') | project ControllerIP = tostring(SearchKey);
let KnownAdmins = _GetWatchlist('QuantumHD_AdminHosts') | project AdminIP = tostring(SearchKey);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (Controllers)
| where SourceIP !in (KnownAdmins)
| extend UriDecoded = url_decode(RequestURL)
| where UriDecoded matches regex @'(?i)(/etc/(passwd|shadow)|\.(cfg|conf|ini|db|bak)\b|backup|passwd|password|credential)'
| summarize Hits = count(), DistinctFiles = dcount(UriDecoded), Files = make_set(UriDecoded, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, SourceUserName
| project FirstSeen, LastSeen, SourceIP, DestinationIP, SourceUserName, Hits, DistinctFiles, Files

Sigma

title: Quantum HD Configuration or Credential File Retrieval via Web Interface
id: 2f8b6d90-4c1a-4e73-9b25-a7d03c5e8b02
status: experimental
description: Detects successful HTTP 200 retrieval of configuration, backup or credential files from a Quantum HD controller web interface, consistent with post-exploitation file read and credential harvesting after CVE-2026-21656 exploitation.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21656
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.collection
    - attack.t1005
    - attack.discovery
    - attack.t1083
    - attack.credential-access
    - attack.t1552.001
    - cve.2026.21656
logsource:
    product: zeek
    service: http
detection:
    selection:
        status_code: 200
        uri|contains:
            - '/etc/passwd'
            - '/etc/shadow'
            - '.cfg'
            - '.conf'
            - '.ini'
            - '.bak'
            - 'backup'
            - 'password'
            - 'credential'
    condition: selection
falsepositives:
    - Engineering staff exporting controller configuration or backups from an approved workstation
    - Scheduled configuration backup jobs
level: high

Known false positives:

  • Approved configuration export or backup from engineering workstations not yet in the admin lookup
  • Vendor support sessions

Tuning notes: Populate quantum_hd_controllers.csv and quantum_hd_admin_hosts.csv (column ip). Raise the hits threshold or add a bytes_returned floor if backup jobs are noisy. Review the usernames field for unexpected or vendor-default accounts (T1078 reuse of recovered credentials).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Quantum HD Injection, Scanning and Flood Activity - Exploitation · unlock with TL Creds
  • Quantum HD Config/Credential File Access from Unknown Host - Post-Exploitation · unlock with TL Creds
  • Quantum HD Controller Outbound Pivot - C2 and Lateral Movement · unlock with TL Creds
  • Sigma: Quantum HD Pre-Auth Code Injection Attempt (CVE-2026-21656) · unlock with TL Creds
  • Sigma: Quantum HD Config/Credential File Retrieval · unlock with TL Creds
  • Sigma: Possible Quantum HD Controller Pivot via Remote Services · unlock with TL Creds
  • Quantum HD Pre-Auth Code Injection Attempt (CVE-2026-21656) - Exploitation · unlock with TL Creds
  • Quantum HD Controller Outbound Pivot / New Egress - C2 and Lateral Movement · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5924.

Sample indicators (2 of 9)

  • URL: hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-057-01
  • URL: hxxps://1898advisories[.]burnsmcd[.]com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

9 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

CVE-2026-21656 affects the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration control platform used worldwide, notably in the Food and Agriculture sector. The vendor states that insufficient validation of input in certain parameters may permit unexpected actions that could affect device security before authentication occurs. NVD classifies the weakness as CWE-94 (Improper Control of Generation of Code, 'Code Injection') and scores it CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor CNA (productsecurity@jci.com) also supplies a CVSS v4.0 score of 8.8 (High). The CISA advisory ICSA-26-057-01 lists the CVE at CVSS v3.1 9.1 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), and the Claroty Team82 disclosure page and the Burns & McDonnell 1898 & Co. write-up also show 9.1. Aviatrix lists 8.8. The sources therefore disagree on the base score; this record uses the NVD primary score.

CISA's ICSA-26-057-01 (released 2026-02-26) states that successful exploitation of the vulnerabilities in the advisory can lead to pre-authentication remote code execution, information leak, or denial of service. The same advisory covers five sibling CVEs: CVE-2026-21654 (CWE-78 OS command injection), CVE-2026-21657 and CVE-2026-21658 (CWE-94), CVE-2026-21659 (CWE-23 relative path traversal) and CVE-2026-21660 (CWE-256 plaintext password storage). CISA notes that the descriptions and CWEs/vectors for CVE-2026-21659 and CVE-2026-21660 do not align cleanly. Burns & McDonnell (1898 & Co.) explains that the four injection flaws (CVE-2026-21654, -21656, -21657, -21658) share a root cause, insufficient input validation on the network-facing interface before authentication, but reach it through different parameters, so no single input-validation fix covers them all and only the firmware upgrade closes every vector. It describes post-exploitation possibilities as filesystem reads and writes, changes to refrigeration control parameters, persistent backdoors, and pivoting into OT or IT networks, and notes that the hardcoded-credential issue (CVE-2026-21660) cannot be addressed by password rotation. These are analyst assessments, not observed attacker behavior. A third-party brief (CraftedSignal) describes the generic attack pattern as a specially crafted request to a network-exposed device that injects code the device then executes, with possible follow-on actions of accessing sensitive information, crashing the device, and moving laterally within the OT network. Aviatrix publishes a modeled attack chain (code injection for initial access, hardcoded credentials for privilege escalation, then lateral movement, C2, exfiltration and disruption) and maps T1190, T1059, T1078, T1003 and T1499; the page itself states it is a modeled scenario, names no actor or victim, and lists no public exploit.

Exploitation status: CISA states that no known public exploitation specifically targeting these vulnerabilities had been reported to CISA at the time of the advisory. The CISA SSVC assessment recorded in NVD is Exploitation: none, Automatable: yes, Technical Impact: total. No public proof-of-concept, exploit code, malware, threat actor, or network IOC (IP/domain/hash) was identified in any source reviewed, and BeaconBeagle correlation was not applicable because there are no network IOCs.

Affected and remediation: NVD lists the Frick Controls Quantum HD firmware, all versions up to and including 10.22, as vulnerable (the hardware CPE is marked not vulnerable). CISA and Claroty state that versions 10.22 through 11 are legacy platforms that have reached end of support. Johnson Controls recommends upgrading to Quantum HD Unity version 12 or higher, then verifying full compliance with the hardening guide and applying all recommended security configurations (Johnson Controls Product Security Advisory JCI-PSA-2026-05). CISA's general ICS guidance applies: minimize network exposure, isolate control systems behind firewalls, and use VPNs for remote access. 1898 & Co. additionally recommends OT network monitoring for anomalous HTTP traffic, unexpected command execution and new outbound connections from controller IPs, plus egress restriction. The vulnerability was reported to CISA by Noam Moshe of Claroty Research Team82.

MITRE ATT&CK techniques by tactic:

Initial Access

T0866 Exploitation of Remote Services; T1190 Exploit Public-Facing Application

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell

Defense Evasion

T1078 Valid Accounts

Credential Access

T1552.001 Credentials In Files

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

  • Upgrade to Quantum HD Unity version 12 or higher per Johnson Controls Product Security Advisory JCI-PSA-2026-05 and the Quantum HD Unity Software Update Procedure

Immediate actions

  • Identify all Frick Controls Quantum HD devices running firmware 10.22 or earlier (including legacy 10.22 through 11 platforms)
  • Remove Quantum HD web/management interfaces from direct internet exposure and isolate control systems behind firewalls
  • Restrict remote access to VPN-only (with strong MFA) and monitor network traffic for suspicious requests to Quantum HD devices
  • Audit for internet-reachable or out-of-perimeter controllers, isolate them first, and log access attempts while unpatched

Workarounds

  • Minimize network exposure of the device and place it behind a firewall
  • Use a VPN for any required remote access
  • Input filtering or WAF rules alone are not sufficient: four separate injection paths exist, so only the firmware upgrade closes every vector

Longer-term hardening

  • Retire end-of-support Quantum HD versions 10.22 through 11 and migrate to Quantum HD Unity version 12 or higher
  • After upgrade, verify full compliance with the Johnson Controls hardening guide and apply all recommended security configurations
  • Segment OT networks to limit lateral movement from a compromised refrigeration controller and restrict controller egress
  • Deploy OT network monitoring for anomalous HTTP requests, unexpected command execution and new outbound connections from controller IPs

Affected and fixed versions

  • Johnson Controls — Frick Controls Quantum HD
    Vulnerable versions: 10.22 and earlier; 10.22 through 11 (legacy, end of support)
    Fixed in: Quantum HD Unity version 12 or higher

Timeline

  • Vulnerabilities in Frick Controls Quantum HD identified in February 2026 (per Aviatrix and 1898 & Co.); Noam Moshe of Claroty Research Team82 reports them to CISA. Exact day not stated, so the first of the month is used.
  • CraftedSignal publishes a brief describing the Quantum HD vulnerabilities and proposing detections for web-interface access attempts and URI-based exploitation attempts.
  • Johnson Controls references Product Security Advisory JCI-PSA-2026-05; versions 10.22 through 11 are identified as end-of-support legacy platforms and upgrade to Quantum HD Unity 12+ is recommended. Vendor remediation is reported available in February 2026.
  • CISA releases ICS advisory ICSA-26-057-01 (Revision 1) covering CVE-2026-21654, -21656, -21657, -21658, -21659 and -21660 in Frick Controls Quantum HD 10.22 and earlier; Noam Moshe of Claroty Team82 credited with reporting.
  • Aviatrix publishes a modeled attack-chain analysis (injection for initial access, hardcoded credentials for escalation, then lateral movement and disruption) mapped to T1190, T1059, T1078, T1003 and T1499; lists no public exploit and cites no real incident.
  • CVE-2026-21656 published in NVD as CWE-94 code injection with CVSS v3.1 9.8 (CISA coordinator SSVC: exploitation none, automatable yes, technical impact total).
  • Burns & McDonnell 1898 & Co. publishes an analysis noting four distinct pre-authentication injection paths (CVE-2026-21654, -21656, -21657, -21658) so only the firmware upgrade closes every vector, and recommends OT monitoring and egress restriction.
  • The 1898 & Co. advisory page is last modified (per page metadata).
  • NVD record last modified and shown as Analyzed; CPE lists Quantum HD firmware up to and including 10.22 as vulnerable.

Sources cited

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats