CVE-2026-21654 is an OS command injection flaw in the Johnson Controls Frick Controls Quantum HD controller, scored 9.8 (Critical). Input in certain parameters is not validated well enough, and the effect comes before authentication. Versions 10.22 and earlier are affected. The vendor says to upgrade to Quantum HD Unity version 12 or higher.
What's affected
- Product: Johnson Controls Frick Controls Quantum HD and its firmware
- Affected: version 10.22 and prior
- Fixed: no patch for these versions. The vendor says versions 10.22 through 11 are legacy platforms that have reached end of support, and recommends upgrading to the Quantum HD Unity platform, version 12 or higher
- Advisory: CISA ICSA-26-057-01, released February 26, 2026, and Johnson Controls advisory JCI-PSA-2026-05
- Sector noted by CISA: Food and Agriculture
- Status: not in the CISA Known Exploited Vulnerabilities catalog
CISA lists six CVEs in the same advisory: CVE-2026-21654, CVE-2026-21656, CVE-2026-21657, CVE-2026-21658, CVE-2026-21659 and CVE-2026-21660. The vendor's recommended upgrade is the same for all of them.
How to check if you're exposed
Industrial controllers are often not in the same inventory as servers, so start with the asset list. Find every Frick Controls Quantum HD in your plant or process control network and read the software version from the controller's own interface or from your commissioning records.
Anything at 10.22 or earlier is affected. Versions 10.22 through 11 are described by the vendor as end of support, so there is no in-place patch to wait for.
Then check reachability. These flaws act before authentication, so what matters is who can send traffic to the controller. Review firewall rules, remote access paths and any internet facing exposure for these devices, and compare them against the vendor hardening guide.
What to do now
- Inventory every Frick Controls Quantum HD and record its software version.
- Plan the upgrade to Quantum HD Unity version 12 or higher, using the vendor update procedure linked in the CISA advisory.
- After upgrading, check the configuration against the vendor hardening guide and apply the recommended security settings.
- Until then, remove any internet exposure, put the controller behind a firewall and use a VPN for remote access, and segment it from business networks.
- Read Johnson Controls advisory JCI-PSA-2026-05 for the mitigation steps the vendor lists.
Why it matters
The record says insufficient validation of input in certain parameters can allow unexpected actions on the device before authentication. The weakness is OS command injection. That makes this a flaw in OS command injection, listed as CWE-78. The advisory warns that successful exploitation can lead to pre-authentication remote code execution, information leaks or denial of service.
The bigger issue is lifecycle. The affected versions are end of support, so the answer is a platform upgrade and not a patch. Plan for it as a project with downtime windows and testing, and keep the controller off any network where untrusted users can reach it until the upgrade is done.
Quick check
Is there a patch for version 10.22?
No patch for these versions is listed. The vendor calls versions 10.22 through 11 end of support and recommends upgrading to Quantum HD Unity version 12 or higher.
Do I need to fix each CVE separately?
No. CISA groups them in one advisory with the same upgrade guidance, so moving to the supported platform covers the set.
Sources
Last reviewed: 19 October 2026.
