CVE-2026-21659: Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion

Q: What is the severity of CVE-2026-21659?

CVE-2026-21659 is classified as a high severity vulnerability due to its potential for unauthenticated remote code execution.

Q: How do I fix CVE-2026-21659?

To fix CVE-2026-21659, ensure that all affected versions of Johnson Controls Frick Controls Quantum HD are updated to the latest patch provided by the vendor.

Q: What systems are affected by CVE-2026-21659?

CVE-2026-21659 affects Johnson Controls Frick Controls Quantum HD systems up to version 10.22.

Q: What type of vulnerability is CVE-2026-21659?

CVE-2026-21659 is a Local File Inclusion (LFI) vulnerability that can lead to unauthenticated remote code execution and information disclosure.

Q: Can CVE-2026-21659 be exploited remotely?

Yes, CVE-2026-21659 can be exploited remotely without authentication.

Published Feb 27, 2026

Updated

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.

Affected Software

3 affected components

Johnson Controls Frick Controls Quantum HD<10.22

All of the following

Johnsoncontrols Frick Controls Quantum Hd Firmware<=10.22

Johnsoncontrols Frick Controls Quantum Hd

Remediation

Information

a. Quantum HD version 10.22 through Version 11 is a previous product platform and is End Of support platform and should be upgraded to new platform with Quantum HD Unity version 12 and above. The update procedure can be found here: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Event History

Feb 27, 2026

CVE Published

via MITRE·09:08 AM

Data Sourced

via MITRE·09:08 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-21659?

CVE-2026-21659 is classified as a high severity vulnerability due to its potential for unauthenticated remote code execution.

How do I fix CVE-2026-21659?

To fix CVE-2026-21659, ensure that all affected versions of Johnson Controls Frick Controls Quantum HD are updated to the latest patch provided by the vendor.

What systems are affected by CVE-2026-21659?