CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (ICSA-26-057-01)

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6026 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-21656 Frick Quantum HD Pre-Auth Code Injection Metacharacters in HTTP Request

Detects unauthenticated HTTP requests whose URI or body carries code/command injection constructs (shell metacharacters, eval/exec/system/popen calls, /bin/sh, cmd.exe). This is the exploitation behaviour for CVE-2026-21656 (CWE-94, ICSA-26-057-01) and its companions CVE-2026-21654/21657/21658 against the Johnson Controls Frick Controls Quantum HD (firmware 10.22 and prior). The exact vulnerable parameters are not public, so the rule is behaviour-first and keys on injection content in any request parameter with no authenticated username.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059
• Data sources: zeek:http (index=zeek, sourcetype=bro:http:json), CommonSecurityLog (NGFW/IDS URL logs), web server / proxy access logs
• Severity: critical
• Confidence: medium

Splunk SPL

index=zeek sourcetype="bro:http:json" earliest=-24h ```comment("CVE-2026-21656 Quantum HD pre-auth code injection hunt")``` | rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip, "id.resp_p" as dest_port | eval req=lower(urldecode(coalesce(uri,"")." ".coalesce(post_body,""))) | where match(req,"(;|[|]|\\x60|[$][(]|eval[(]|exec[(]|system[(]|popen[(]|os[.]system|/bin/sh|cmd[.]exe)") | where isnull(username) OR username="-" | stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(user_agent) as user_agents values(status_code) as status_codes by src_ip dest_ip dest_port | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let QHD = _GetWatchlist('QuantumHD') | project SearchKey;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (QHD)
| extend Req = tolower(url_decode(RequestURL))
| where Req matches regex @"(;|[|]|`|[$][(]|eval[(]|exec[(]|system[(]|popen[(]|os[.]system|/bin/sh|cmd[.]exe)"
| where isempty(SourceUserName) or SourceUserName == "-"
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL, SourceUserName, DeviceVendor, DeviceAction

Sigma

title: Frick Quantum HD Injection Metacharacters in Web Request (CVE-2026-21656)
id: 3b9f6c1e-52a4-4d7e-9c18-6a0e1f2b7d41
status: experimental
description: Detects HTTP requests to a Quantum HD controller web interface carrying code or command injection constructs, the pre-authentication exploitation pattern for CVE-2026-21656 (CWE-94, ICSA-26-057-01).
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21656
author: Threadlinqs Team
date: 2026/11/14
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - cve.2026.21656
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - ';'
            - '|'
            - '$('
            - '%3b'
            - '%7c'
            - '%24%28'
            - 'eval('
            - 'exec('
            - 'system('
            - 'popen('
            - '/bin/sh'
            - 'cmd.exe'
    condition: selection
falsepositives:
    - Legitimate engineering tools posting configuration values containing semicolons
    - Vulnerability scanners run by the OT security team
level: high

Known false positives:

• Engineering workstations submitting configuration values that legitimately contain semicolons or pipes
• Authorised vulnerability scanning of OT segments

Tuning notes: Restrict to Quantum HD controller addresses (join quantum_hd_assets.csv or the QuantumHD watchlist) and exclude approved engineering hosts and scanners. The vulnerable parameter names are not public, so start in alert-for-review mode and tighten the regex once real controller traffic is baselined. Requires HTTP visibility (span/tap or TLS-terminating proxy) on the OT segment.

• 🔒 Quantum HD Code Injection Keywords in Requests from Non-Engineering Hosts (CVE-2026-21657 / CVE-2026-21658) · unlock with TL Creds
• 🔒 Quantum HD Credential or Configuration File Retrieval via Web Interface (CVE-2026-21659 / CVE-2026-21660) · unlock with TL Creds
• 🔒 Quantum HD Controller Request Flood Indicating Denial of Service (T0814) · unlock with TL Creds
• 🔒 Quantum HD Relative Path Traversal in Web Request (CVE-2026-21659) · unlock with TL Creds
• 🔒 Quantum HD Successful Web Logon with Default or Generic Account (CVE-2026-21660) · unlock with TL Creds
• 🔒 Quantum HD Setpoint or Safety Limit Change Request from Unapproved Host · unlock with TL Creds
• 🔒 Quantum HD Controller Shell or Download Command Execution in Syslog (CVE-2026-21656 / CVE-2026-21654) · unlock with TL Creds
• 🔒 Quantum HD Controller Initiating Outbound Connections to Non-Private Addresses · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-6026.

Sample indicators (2 of 7)

• Domain: frickcontrolsblob[.]file[.]core[.]windows[.]net
• URL: hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-057-01

Defanged, TLP:CLEAR. Full set of 7 indicators: unlock with TL Creds.

Technical analysis

CVE-2026-21656 affects the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller used in food and agriculture. Insufficient validation of input in certain parameters may permit unexpected actions that affect device security before authentication occurs. NVD classifies the weakness as CWE-94 (Improper Control of Generation of Code, 'Code Injection'), as reported by Johnson Controls.

The flaw was disclosed through CISA ICS advisory ICSA-26-057-01 (released 2026-02-26) together with five companion vulnerabilities in the same product: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21657 and CVE-2026-21658 (both CWE-94 code injection, 9.1), CVE-2026-21659 (CWE-23 relative path traversal, 7.5) and CVE-2026-21660 (hardcoded/plaintext credential issue, 6.2). CISA states that successful exploitation can lead to pre-authentication remote code execution, information leak or denial of service. Noam Moshe of Claroty Team82 reported the vulnerabilities to CISA. A Burns & McDonnell advisory describes CVE-2026-21656, -21657 and -21658 as pre-authentication code injection through different network-facing parameters. That is a third-party summary and was not checked against the CISA or NVD records.

Scoring: CISA and the Claroty dashboard give CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). NVD's own primary assessment is CVSS v3.1 9.8 (C:H/I:H/A:H), and the Johnson Controls CVSS v4.0 score is 8.8 (High). NVD lists vulnerable versions as 10.22 and prior. The vendor describes versions 10.22 through 11 as legacy platforms that have reached end of support.

Exploitation status: CISA's advisory says no known public exploitation specifically targeting these vulnerabilities had been reported to CISA at publication. The CISA SSVC assessment recorded in NVD shows exploitation 'none', automatable 'yes' and technical impact 'total'. The sources state no public PoC, IOCs, threat actor attribution or CISA KEV listing. A network-reachable controller with no required credentials is a plausible route to arbitrary code execution and to changes to refrigeration setpoints and safety limits, as the Burns & McDonnell summary describes. That impact is analyst assessment from that third-party source, not a documented incident.

Remediation: upgrade to Quantum HD Unity version 12 or higher, then verify full compliance with the hardening guide and apply all recommended security configurations (Johnson Controls Product Security Advisory JCI-PSA-2026-05). CISA's general guidance applies: minimize network exposure, keep control devices off the internet, isolate them behind firewalls away from business networks, and use updated VPNs for remote access.

MITRE ATT&CK techniques by tactic:

Inhibit Response Function

T0814 Denial of Service

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Remediation

Patches

• Quantum HD Unity version 12 or higher, per the Johnson Controls Quantum HD Unity Software Update Procedure and JCI-PSA-2026-05

Immediate actions

• Identify every Frick Controls Quantum HD controller running firmware 10.22 or earlier (versions 10.22 through 11 are end-of-support)
• Remove controller web/network interfaces from the internet and from business (IT) networks
• Place controllers behind firewalls on isolated OT segments
• Log and review access attempts to controller network interfaces

Workarounds

• No vendor workaround stated; CISA recommends minimizing network exposure, keeping devices off the internet and isolating them behind firewalls

Longer-term hardening

• Upgrade to Quantum HD Unity version 12 or higher
• After upgrade, verify full compliance with the Johnson Controls hardening guide and apply all recommended security configurations
• Use updated VPNs for any remote access and keep the VPN software current
• Monitor OT traffic for anomalous HTTP activity, unexpected command execution and new outbound connections
• Perform impact analysis and risk assessment before deploying defensive measures

Affected and fixed versions

• Johnson Controls — Frick Controls Quantum HD
  Vulnerable versions: 10.22 and prior (versions 10.22 through 11 are end-of-support legacy platforms)
  Fixed in: Quantum HD Unity version 12 and later

Timeline

• 2026-02-26 Johnson Controls directs customers of end-of-support versions 10.22 through 11 to upgrade to Quantum HD Unity v12 or higher and apply the hardening guide (JCI-PSA-2026-05).
• 2026-02-26 CISA releases ICS advisory ICSA-26-057-01 (Revision 1) covering Frick Controls Quantum HD <=10.22 and six CVEs including CVE-2026-21656; Noam Moshe of Claroty Team82 credited with reporting them. CISA reports no known public exploitation.
• 2026-02-27 CVE-2026-21656 published in NVD as CWE-94 code injection; NVD primary CVSS v3.1 9.8, Johnson Controls CVSS v4.0 8.8.
• 2026-03-06 Burns & McDonnell 1898 Advisories publishes a summary describing the six pre-authentication vulnerabilities and OT mitigations for the Quantum HD refrigeration controller.
• 2026-04-29 Burns & McDonnell advisory page is modified (JSON-LD dateModified).
• 2026-06-17 NVD record for CVE-2026-21656 last modified; status Analyzed, CISA SSVC shows exploitation none, automatable yes, technical impact total.

Sources cited

• CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD CISA · Government advisory · 2026-02-26
• NVD - CVE-2026-21656 NVD (NIST) · Advisory · 2026-02-27
• INCIBE-CERT Early Warning - CVE-2026-21656 incibe.es · Advisory
• Claroty Team82 Disclosure Dashboard - CVE-2026-21656 claroty.com · Research
• Johnson Controls Product Security Advisories (JCI-PSA-2026-05) johnsoncontrols.com · Vendor report
• SentinelOne Vulnerability Database - CVE-2026-21656 SentinelOne · Research
• GCVE - CVE-2026-21656 db.gcve.eu · Research
• Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD Industrial Refrigeration Controller 1898advisories.burnsmcd.com · Blog · 2026-03-06

More in vulnerability

• FreeRDP client-side RCE chain (CVE-2026-91964 heap overflow + CVE-2026-91963 USB redirection heap disclosure) found via AI-agent vulnerability research workflow
• Ivanti EPM Core Critical SQL Injection Enabling Unauthenticated RCE (CVE-2026-121653) and Multiple Ivanti CSA/EPMM/Sentry/UWM Flaws
• UnrealIRCd labeled-response IRCv3 label tag injection (CVE-2026-114713) exploited in the wild
• LiteLLM semantic cache tenant isolation bypass (CVE-2026-89032)
• PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)

Related coverage of this activity

• Frick Quantum HD command injection
• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD
• Frick Quantum HD CVE-2026-21656
• CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Code
• Frick Quantum HD flaw

Previous and next in vulnerability

• Edito CMS multiple vulnerabilities incl. JWT refresh signature bypass (CVE-2026-59074) enabling account takeover Previous report
• CVE-2026-21654: Pre-Authentication OS Command Injection in Johnson Controls Frick Controls Quantum HD (10.22 through 11) Next report