Threat reportICS/SCADATL-2026-3552
CVE-2026-28256: Hard-coded Security-Relevant Constants in Trane Tracer SC, Tracer SC+ and Tracer Concierge
CVE-2026-28256 (TL-2026-3552), also tracked as ICSA-26-071-01, is a medium-severity ICS/SCADA threat scored CVSS 5.8, first published 2026-10-14. It has no confirmed attribution, affects Trane Tracer SC, references 1 CVE (CVE-2026-28256), maps to 5 MITRE ATT&CK techniques (T1059, T1078, T1190), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 5.8/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3552
- Threat ID
- TL-2026-3552
- Also known as
- ICSA-26-071-01
- Severity
- MEDIUM
- CVSS
- 5.8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N)
- Status
- MONITORING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- critical-manufacturing, building-automation, commercial-facilities
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-28256 works
A use of hard-coded, security-relevant constants (CWE-547) in Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers could let an attacker disclose sensitive information and take over accounts. Trane has implemented enhanced (cloud) security controls, and Tracer SC+ users are asked to upgrade to v6.30.2313; no public exploitation was reported at advisory release.
CVE-2026-28256 was published on 2026-03-12 as part of CISA ICS Advisory ICSA-26-071-01, which covers five Trane Tracer vulnerabilities (CVE-2026-28252 through CVE-2026-28256). It affects Trane Tracer SC (versions before v4.4 SP7), Tracer SC+ (before v6.3.2310) and Tracer Concierge (before v6.3.2310). The weakness is classified as CWE-547, Use of Hard-coded, Security-relevant Constants. According to the CVE record and CISA, it could allow an attacker to disclose sensitive information and take over accounts. The Claroty Team82 disclosure page also lists arbitrary command execution and denial of service as possible consequences of exploitation.
CISA scores the issue CVSS v3.1 5.8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N): network-reachable, high attack complexity, high privileges required, scope changed, high confidentiality impact. The CNA-assigned CVSS v4.0 score is 6.9 (AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N). Tenable lists a different, higher CVSS v3 value (9.8) for its OT plugin; this record follows the CISA and CNA values. The advisory does not publish the exact constants involved or an exploitation procedure, so the technical mechanism beyond the CWE classification is not documented in the sources.
The sibling flaws in the same advisory are CVE-2026-28252 (broken cryptographic algorithm, authentication bypass and root access, CVSS 8.1), CVE-2026-28253 (excessive memory allocation, unauthenticated DoS, CVSS 7.5), CVE-2026-28254 (missing authorization on unprotected APIs, CVSS 5.8) and CVE-2026-28255 (hard-coded credentials, CWE-798, CVSS 6.8). Third-party commentary suggests chaining these could increase impact, but that is analyst inference, not a documented attack.
Vendor mitigation: Trane states it implemented enhanced security controls communicated to customers (and enhanced cloud security controls for CVE-2026-28255/28256). Tracer SC+ users are asked to upgrade to v6.30.2313. Defenders should additionally isolate controllers from the internet and segment building-automation networks. The vulnerability was reported to CISA by Noam Moshe of Claroty Team82. CISA lists the affected sector as Critical Manufacturing, deployed worldwide, with Trane headquartered in Ireland. No known public exploitation or public PoC was reported at release.
MITRE ATT&CK techniques used in TL-2026-3552
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories
Credential Access
Affected products and versions in CVE-2026-28256
- Trane — Tracer SC
Vulnerable versions: < v4.4 SP7
Fixed in: v4.4 SP7 - Trane — Tracer SC+
Vulnerable versions: < v6.3.2310
Fixed in: v6.3.2310; v6.30.2313 (vendor-requested upgrade) - Trane — Tracer Concierge
Vulnerable versions: < v6.3.2310
Fixed in: v6.3.2310
Remediation for CVE-2026-28256
Patches
- Tracer SC: v4.4 SP7 or later
- Tracer SC+: v6.3.2310 or later (Trane requests v6.30.2313)
- Tracer Concierge: v6.3.2310 or later
Immediate actions
- Upgrade Tracer SC+ to v6.30.2313 as requested by Trane
- Contact Trane for the enhanced security controls communicated to customers
- Ensure Tracer controllers are not directly reachable from the internet
Workarounds
- Trane enhanced cloud security controls (per CISA advisory)
- Firewall isolation and disabling internet accessibility of affected devices
Longer-term hardening
- Segment building-automation networks behind firewalls and isolate them from business networks
- Inventory all Tracer SC, SC+ and Concierge units and track firmware versions
- Monitor controller authentication and API activity for anomalous account use
CVEs associated with CVE-2026-28256
Weaknesses (CWE) in CVE-2026-28256
Timeline of CVE-2026-28256
- CVE-2026-28256 reserved in the CVE Program.
- Noam Moshe of Claroty (Team82) credited with reporting the vulnerability to CISA; Team82 posts disclosure page.
- Trane reports enhanced security controls implemented and communicated to customers; Tracer SC+ users asked to upgrade to v6.30.2313.
- CISA publishes ICS Advisory ICSA-26-071-01 covering CVE-2026-28252 to CVE-2026-28256 in Trane Tracer SC, SC+ and Concierge; CVE record published.
- Security Arsenal publishes an analysis of the Trane Tracer advisory recommending patching and network segmentation.
- Tenable OT Security plugin 505311 published for CVE-2026-28256.
- Tenable plugin record updated; no known public exploit listed.
Sources cited for CVE-2026-28256
- CISA ICS Advisory ICSA-26-071-01 - Trane Tracer SC, SC+ and Concierge
- Claroty Team82 Disclosure Dashboard - CVE-2026-28256
- CVE Record CVE-2026-28256 (CVE Program)
- Tenable OT Security Plugin 505311 - CVE-2026-28256
- Security Arsenal - Critical Flaws in Trane Tracer Controllers Expose HVAC Systems
- CWE-547: Use of Hard-coded, Security-relevant Constants
Detection coverage for TL-2026-3552
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3552 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.