What is the CVSS score of CVE-2026-21659?

CVE-2026-21659 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Frick Controls Quantum Hd Firmware are affected by CVE-2026-21659?

Johnson Controls Frick Controls Quantum HD devices are exposed to unauthenticated remote code execution, allowing attackers to gain complete control without credentials or authentication.

How to fix or mitigate CVE-2026-21659?

Within 24 hours: Inventory all Frick Controls Quantum HD devices and assess network exposure; isolate affected systems from untrusted networks if possible. Within 7 days: Implement network segmentation to restrict access to these devices, disable remote management features if operationally feasible, and deploy WAF/IDS rules to block exploitation attempts. Within 30 days: Establish continuous monitoring for suspicious activity, contact Johnson Controls for patch availability updates, and develop contingency plans for manual system operation.

Frick Controls Quantum Hd Firmware CVE-2026-21659

CRITICAL

Relative Path Traversal (CWE-23)

2026-02-27 productsecurity@jci.com

RCE Information Disclosure LFI Frick Controls Quantum Hd Firmware Johnsoncontrols

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 10:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.

AnalysisAI

Unauthenticated RCE and information disclosure via Local File Inclusion in Johnson Controls Frick Controls. Fifth critical vulnerability in the product line, enabling arbitrary file reads and code execution.

Technical ContextAI

CWE-23 relative path traversal. Local File Inclusion enables reading arbitrary files and achieving code execution through inclusion of malicious content.