What’s Vulnerable › Vulnerabilities

CVE-2026-21657: Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-27 · updated 2026-06-17
• Weakness: CWE-94

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

Affected products

• Johnson Controls Frick Controls Quantum HD: through 10.22

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01
• https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Get alerted when CVE-2026-21657 or the next vulnerability affects your stack