# CVE-2026-28256: Hard-coded Security-Relevant Constants in Trane Tracer SC, Tracer SC+ and Tracer Concierge

> A use of hard-coded, security-relevant constants (CWE-547) in Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers could let an attacker disclose sensitive information and take over accounts. Trane has implemented enhanced (cloud) security controls, and Tracer SC+ users are asked to upgrade to v6.30.2313; no public exploitation was reported at advisory release.

- **Published:** 2026-10-14T21:07:55Z
- **Last reviewed:** 2026-10-14T21:07:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3552
- **ID:** TL-2026-3552
- **Severity:** MEDIUM (CVSS 5.8)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-28256

## Description

CVE-2026-28256 was published on 2026-03-12 as part of CISA ICS Advisory ICSA-26-071-01, which covers five Trane Tracer vulnerabilities (CVE-2026-28252 through CVE-2026-28256). It affects Trane Tracer SC (versions before v4.4 SP7), Tracer SC+ (before v6.3.2310) and Tracer Concierge (before v6.3.2310). The weakness is classified as CWE-547, Use of Hard-coded, Security-relevant Constants. According to the CVE record and CISA, it could allow an attacker to disclose sensitive information and take over accounts. The Claroty Team82 disclosure page also lists arbitrary command execution and denial of service as possible consequences of exploitation.

CISA scores the issue CVSS v3.1 5.8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N): network-reachable, high attack complexity, high privileges required, scope changed, high confidentiality impact. The CNA-assigned CVSS v4.0 score is 6.9 (AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N). Tenable lists a different, higher CVSS v3 value (9.8) for its OT plugin; this record follows the CISA and CNA values. The advisory does not publish the exact constants involved or an exploitation procedure, so the technical mechanism beyond the CWE classification is not documented in the sources.

The sibling flaws in the same advisory are CVE-2026-28252 (broken cryptographic algorithm, authentication bypass and root access, CVSS 8.1), CVE-2026-28253 (excessive memory allocation, unauthenticated DoS, CVSS 7.5), CVE-2026-28254 (missing authorization on unprotected APIs, CVSS 5.8) and CVE-2026-28255 (hard-coded credentials, CWE-798, CVSS 6.8). Third-party commentary suggests chaining these could increase impact, but that is analyst inference, not a documented attack.

Vendor mitigation: Trane states it implemented enhanced security controls communicated to customers (and enhanced cloud security controls for CVE-2026-28255/28256). Tracer SC+ users are asked to upgrade to v6.30.2313. Defenders should additionally isolate controllers from the internet and segment building-automation networks. The vulnerability was reported to CISA by Noam Moshe of Claroty Team82. CISA lists the affected sector as Critical Manufacturing, deployed worldwide, with Trane headquartered in Ireland. No known public exploitation or public PoC was reported at release.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1059 Command and Scripting Interpreter

## Sources

- [CISA ICS Advisory ICSA-26-071-01 - Trane Tracer SC, SC+ and Concierge](https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-28256](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-28256)
- [CVE Record CVE-2026-28256 (CVE Program)](https://cveawg.mitre.org/api/cve/CVE-2026-28256)
- [Tenable OT Security Plugin 505311 - CVE-2026-28256](https://www.tenable.com/plugins/ot/505311)
- [Security Arsenal - Critical Flaws in Trane Tracer Controllers Expose HVAC Systems](https://securityarsenal.com/blog/critical-flaws-in-trane-tracer-controllers-expose-hvac-systems-to-root-attacks)
- [CWE-547: Use of Hard-coded, Security-relevant Constants](https://db.gcve.eu/cwe/CWE-547)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3552