PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-21659 Unknown Vendor CVE debrief

CVE-2026-21659 is a high-severity OT vulnerability in Johnson Controls Frick Controls Quantum HD. According to the CISA advisory, an unauthenticated attacker can execute arbitrary code on the affected device, which can result in full system compromise. Because the issue is unauthenticated and remotely reachable in the CVSS vector, affected environments should treat this as an urgent remediation item.

Vendor
Unknown Vendor
Product
Johnson Controls, Inc. Frick Controls Quantum HD <=10.22
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-02-26
Advisory published
2026-02-26
Advisory updated
2026-02-26

Who should care

Industrial control system owners, OT/ICS administrators, facility operators, and integrators running Frick Controls Quantum HD should prioritize this issue, especially where the device is exposed to untrusted networks or supports critical refrigeration and control operations.

Technical summary

The supplied CISA CSAF advisory describes CVE-2026-21659 as an unauthenticated arbitrary-code-execution vulnerability in Frick Controls Quantum HD, with potential for full system compromise. The provided CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, corresponding to a HIGH severity score of 7.5. The remediation guidance in the advisory recommends moving legacy Quantum HD platforms to Quantum HD Unity version 12 or higher and then applying the vendor’s hardening guidance.

Defensive priority

High. This is an unauthenticated RCE affecting an ICS/OT product, so exposure should be treated as urgent, particularly on production or remotely accessible systems.

Recommended defensive actions

  • Identify all Frick Controls Quantum HD deployments and confirm whether they match the advisory’s affected scope.
  • Plan and execute the vendor-recommended upgrade to Quantum HD Unity version 12 or higher, using the published update procedure.
  • After upgrading, verify compliance with the vendor hardening guide and apply all recommended security configurations.
  • Restrict network exposure to the device to only necessary management and operational paths while remediation is in progress.
  • Monitor for unexpected device behavior, configuration changes, and anomalous network activity until remediation is complete.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-057-01, initially published on 2026-02-26, and the supplied CVE record metadata. The corpus indicates no KEV listing and no ransomware-campaign association. Vendor remediation guidance in the advisory recommends upgrading legacy Quantum HD platforms to version 12 or higher and then applying hardening recommendations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-21659 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-21659

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-21659 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21659

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-057-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.