What is the CVSS score of CVE-2026-21659?

CVE-2026-21659 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-21659?

Within 24 hours: Inventory all Frick Controls Quantum HD devices and assess network exposure; isolate affected systems from untrusted networks if possible. Within 7 days: Implement network segmentation to restrict access to these devices, disable remote management features if operationally feasible, and deploy WAF/IDS rules to block exploitation attempts. Within 30 days: Establish continuous monitoring for suspicious activity, contact Johnson Controls for patch availability updates, and develop contingency plans for manual system operation.

Frick Controls Quantum Hd Firmware CVE-2026-21659

CRITICAL

Relative Path Traversal (CWE-23)

2026-02-27 productsecurity@jci.com

RCE Information Disclosure LFI Frick Controls Quantum Hd Firmware Johnsoncontrols

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted HTTP request with LFI payload
Delivery

Access local files via path traversal
Exploit

Include malicious PHP/script file
Execution

Execute arbitrary code on device
Impact

Achieve full system compromise

Vulnerability Assessment

Weakness	CWE CWE-23 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Relative path traversal prevention
Exploitation Conditions	No special conditions — remote unauthenticated exploitation against default configurations of Johnson Controls Frick Controls Quantum HD versions 10.22 and prior via unprotected HTTP endpoints vulnerable to Local File Inclusion.
Impact	CVSS 9.8, EPSS 0.28%. LFI can expose credentials, configuration, and enable RCE through log poisoning or inclusion of uploaded files.
Exploit ScenarioDerived	Attacker uses LFI to read system credentials or include a file containing attacker-controlled PHP/code, achieving remote code execution.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Unauthenticated RCE and information disclosure via Local File Inclusion in Johnson Controls Frick Controls. Fifth critical vulnerability in the product line, enabling arbitrary file reads and code execution.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.8

LFI leading to RCE in Johnson Controls Frick Controls — fifth CVE.

RemediationAI

Apply vendor patch. This is the fifth critical CVE — comprehensive security review of the product is warranted.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-23 relative path traversal. Local File Inclusion enables reading arbitrary files and achieving code execution through inclusion of malicious content.

Know when Frick Controls Quantum Hd Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.

Executive ViewAI

Why It Matters

Johnson Controls Frick Controls Quantum HD devices are exposed to unauthenticated remote code execution, allowing attackers to gain complete control without credentials or authentication. Organizations operating these HVAC/refrigeration controllers face immediate risk of operational disruption, data theft, and potential safety incidents if systems are compromised.

Business Impact: Severe

Compensating Controls

Implement network segmentation to restrict device access to authorized personnel only; disable remote management and web interfaces if not critical to operations; deploy intrusion detection signatures targeting Quantum HD exploitation; restrict administrative access via firewall rules; enable detailed logging and monitoring for anomalous behavior; consider running affected systems in air-gapped or restricted-access networks until patch is available.

Threat Intelligence Overview

EPSS Score

0.3%

Top 49% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Local File Inclusion HIGH

Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.