# CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (ICSA-26-057-01)

> CVE-2026-21656 is a pre-authentication code injection flaw (CWE-94) in the Johnson Controls Frick Controls Quantum HD industrial refrigeration controller, firmware 10.22 and earlier. CISA rates it CVSS v3.1 9.1; no public exploitation had been reported to CISA at publication, and the vendor fix is an upgrade to Quantum HD Unity v12 or later.

- **Published:** 2026-11-14T02:48:47Z
- **Last reviewed:** 2026-11-14T02:48:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6026
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6026.png
- **ID:** TL-2026-6026
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7 (2 shown free below)
- **CVEs:** CVE-2026-21656

## Description

CVE-2026-21656 affects the Johnson Controls Frick Controls Quantum HD, an industrial refrigeration controller used in food and agriculture. Insufficient validation of input in certain parameters may permit unexpected actions that affect device security before authentication occurs. NVD classifies the weakness as CWE-94 (Improper Control of Generation of Code, 'Code Injection'), as reported by Johnson Controls.

The flaw was disclosed through CISA ICS advisory ICSA-26-057-01 (released 2026-02-26) together with five companion vulnerabilities in the same product: CVE-2026-21654 (CWE-78 OS command injection, 9.1), CVE-2026-21657 and CVE-2026-21658 (both CWE-94 code injection, 9.1), CVE-2026-21659 (CWE-23 relative path traversal, 7.5) and CVE-2026-21660 (hardcoded/plaintext credential issue, 6.2). CISA states that successful exploitation can lead to pre-authentication remote code execution, information leak or denial of service. Noam Moshe of Claroty Team82 reported the vulnerabilities to CISA. A Burns & McDonnell advisory describes CVE-2026-21656, -21657 and -21658 as pre-authentication code injection through different network-facing parameters. That is a third-party summary and was not checked against the CISA or NVD records.

Scoring: CISA and the Claroty dashboard give CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). NVD's own primary assessment is CVSS v3.1 9.8 (C:H/I:H/A:H), and the Johnson Controls CVSS v4.0 score is 8.8 (High). NVD lists vulnerable versions as 10.22 and prior. The vendor describes versions 10.22 through 11 as legacy platforms that have reached end of support.

Exploitation status: CISA's advisory says no known public exploitation specifically targeting these vulnerabilities had been reported to CISA at publication. The CISA SSVC assessment recorded in NVD shows exploitation 'none', automatable 'yes' and technical impact 'total'. The sources state no public PoC, IOCs, threat actor attribution or CISA KEV listing. A network-reachable controller with no required credentials is a plausible route to arbitrary code execution and to changes to refrigeration setpoints and safety limits, as the Burns & McDonnell summary describes. That impact is analyst assessment from that third-party source, not a documented incident.

Remediation: upgrade to Quantum HD Unity version 12 or higher, then verify full compliance with the hardening guide and apply all recommended security configurations (Johnson Controls Product Security Advisory JCI-PSA-2026-05). CISA's general guidance applies: minimize network exposure, keep control devices off the internet, isolate them behind firewalls away from business networks, and use updated VPNs for remote access.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Valid Accounts: Default Accounts
- T1059 Command and Scripting Interpreter
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System
- T0814 Denial of Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-21656 Frick Quantum HD Pre-Auth Code Injection Metacharacters in HTTP Request** (`TL-2026-6026-SPL-001`)

Detects unauthenticated HTTP requests whose URI or body carries code/command injection constructs (shell metacharacters, eval/exec/system/popen calls, /bin/sh, cmd.exe). This is the exploitation behaviour for CVE-2026-21656 (CWE-94, ICSA-26-057-01) and its companions CVE-2026-21654/21657/21658 against the Johnson Controls Frick Controls Quantum HD (firmware 10.22 and prior). The exact vulnerable parameters are not public, so the rule is behaviour-first and keys on injection content in any request parameter with no authenticated username.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059
- **Data sources:** zeek:http (index=zeek, sourcetype=bro:http:json), CommonSecurityLog (NGFW/IDS URL logs), web server / proxy access logs
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

````spl
index=zeek sourcetype="bro:http:json" earliest=-24h ```comment("CVE-2026-21656 Quantum HD pre-auth code injection hunt")``` | rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip, "id.resp_p" as dest_port | eval req=lower(urldecode(coalesce(uri,"")." ".coalesce(post_body,""))) | where match(req,"(;|[|]|\\x60|[$][(]|eval[(]|exec[(]|system[(]|popen[(]|os[.]system|/bin/sh|cmd[.]exe)") | where isnull(username) OR username="-" | stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(user_agent) as user_agents values(status_code) as status_codes by src_ip dest_ip dest_port | convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let QHD = _GetWatchlist('QuantumHD') | project SearchKey;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (QHD)
| extend Req = tolower(url_decode(RequestURL))
| where Req matches regex @"(;|[|]|`|[$][(]|eval[(]|exec[(]|system[(]|popen[(]|os[.]system|/bin/sh|cmd[.]exe)"
| where isempty(SourceUserName) or SourceUserName == "-"
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL, SourceUserName, DeviceVendor, DeviceAction
```

### Sigma

```yaml
title: Frick Quantum HD Injection Metacharacters in Web Request (CVE-2026-21656)
id: 3b9f6c1e-52a4-4d7e-9c18-6a0e1f2b7d41
status: experimental
description: Detects HTTP requests to a Quantum HD controller web interface carrying code or command injection constructs, the pre-authentication exploitation pattern for CVE-2026-21656 (CWE-94, ICSA-26-057-01).
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21656
author: Threadlinqs Team
date: 2026/11/14
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - cve.2026.21656
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - ';'
            - '|'
            - '$('
            - '%3b'
            - '%7c'
            - '%24%28'
            - 'eval('
            - 'exec('
            - 'system('
            - 'popen('
            - '/bin/sh'
            - 'cmd.exe'
    condition: selection
falsepositives:
    - Legitimate engineering tools posting configuration values containing semicolons
    - Vulnerability scanners run by the OT security team
level: high
```

**Known false positives:**

- Engineering workstations submitting configuration values that legitimately contain semicolons or pipes
- Authorised vulnerability scanning of OT segments

**Tuning notes:** Restrict to Quantum HD controller addresses (join quantum_hd_assets.csv or the QuantumHD watchlist) and exclude approved engineering hosts and scanners. The vulnerable parameter names are not public, so start in alert-for-review mode and tighten the regex once real controller traffic is baselined. Requires HTTP visibility (span/tap or TLS-terminating proxy) on the OT segment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Quantum HD Code Injection Keywords in Requests from Non-Engineering Hosts (CVE-2026-21657 / CVE-2026-21658) (locked: unlock with TL Creds)
- Quantum HD Credential or Configuration File Retrieval via Web Interface (CVE-2026-21659 / CVE-2026-21660) (locked: unlock with TL Creds)
- Quantum HD Controller Request Flood Indicating Denial of Service (T0814) (locked: unlock with TL Creds)
- Quantum HD Relative Path Traversal in Web Request (CVE-2026-21659) (locked: unlock with TL Creds)
- Quantum HD Successful Web Logon with Default or Generic Account (CVE-2026-21660) (locked: unlock with TL Creds)
- Quantum HD Setpoint or Safety Limit Change Request from Unapproved Host (locked: unlock with TL Creds)
- Quantum HD Controller Shell or Download Command Execution in Syslog (CVE-2026-21656 / CVE-2026-21654) (locked: unlock with TL Creds)
- Quantum HD Controller Initiating Outbound Connections to Non-Private Addresses (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 7)

Defanged, TLP:CLEAR.

- Domain: `frickcontrolsblob[.]file[.]core[.]windows[.]net`
- URL: `hxxps://www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-057-01`

Full set of 7 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-21656](https://claroty.com/team82/disclosure-dashboard/cve-2026-21656)
- [CISA ICS Advisory ICSA-26-057-01 - Johnson Controls Frick Controls Quantum HD](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01)
- [NVD - CVE-2026-21656](https://nvd.nist.gov/vuln/detail/CVE-2026-21656)
- [Johnson Controls Product Security Advisories (JCI-PSA-2026-05)](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories)
- [Burns & McDonnell 1898 Advisories - Critical Pre-Authentication Vulnerabilities in Frick Controls Quantum HD Industrial Refrigeration Controller](https://1898advisories.burnsmcd.com/johnson-controls-critical-pre-authentication-vulnerabilities-in-frick-controls-quantum-hd-industrial-refrigeration-controller)
- [SentinelOne Vulnerability Database - CVE-2026-21656](https://www.sentinelone.com/vulnerability-database/cve-2026-21656/)
- [INCIBE-CERT Early Warning - CVE-2026-21656](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2026-21656)
- [GCVE - CVE-2026-21656](https://db.gcve.eu/vuln/CVE-2026-21656)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6026