Threat reportVulnerabilityTL-2026-3555
CVE-2026-28254: Missing Authorization in Trane Tracer SC, Tracer SC+ and Tracer Concierge Building Management Controllers
CVE-2026-28254 (TL-2026-3555), also tracked as ICSA-26-071-01, is a medium-severity software vulnerability scored CVSS 5.8, first published 2026-10-14. It has no confirmed attribution, affects Trane Tracer SC, references 1 CVE (CVE-2026-28254), maps to 4 MITRE ATT&CK techniques (T1005, T1059, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 5.8/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3555
- Threat ID
- TL-2026-3555
- Also known as
- ICSA-26-071-01
- Severity
- MEDIUM
- CVSS
- 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- critical manufacturing, commercial facilities, building automation
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 10
How CVE-2026-28254 works
A missing authorization flaw (CWE-862) in Trane Tracer SC, Tracer SC+ and Tracer Concierge building management systems lets an unauthenticated network attacker reach sensitive information through unprotected APIs. Fixed in Tracer SC+ v6.30.2313; no public exploitation reported to CISA.
CVE-2026-28254 is a Missing Authorization vulnerability (CWE-862) in Trane Tracer SC, Tracer SC+ and Tracer Concierge. Per the CVE/NVD description, an unauthenticated attacker could access sensitive information through unprotected APIs. The Claroty Team82 disclosure page additionally lists possible consequences of sensitive data disclosure, command execution or denial of service; that wording comes from the Claroty summary and the primary CVE description only states information access.
The flaw was disclosed through CISA ICS Advisory ICSA-26-071-01 (released 2026-03-12, sector: Critical Manufacturing, worldwide deployment, vendor HQ Ireland). Credit goes to Noam Moshe of Claroty Team82. The advisory bundles five CVEs in the same product family: CVE-2026-28252 (broken cryptographic algorithm, CWE-327), CVE-2026-28253 (excessive memory allocation, CWE-789), CVE-2026-28254 (this issue), CVE-2026-28255 (hard-coded credentials, CWE-798) and CVE-2026-28256 (hard-coded security constants, CWE-547). Only CVE-2026-28254 is the subject of this record; the siblings are listed for context.
Affected versions per the CISA advisory: Tracer SC before v4.4_SP7, Tracer SC+ before v6.3.2310, and Tracer Concierge before v6.3.2310. Trane's fix for Tracer SC+ is v6.30.2313, which addresses CVE-2026-28252, CVE-2026-28253 and CVE-2026-28254. A secondary report (Security Arsenal) names Tracer SC v4.4_SP7 as the fixed Tracer SC release; this was not independently confirmed in the primary advisory text retrieved.
Scoring differs by source. The CISA advisory scores the issue CVSS 5.8 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). NVD records CVSS v3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CVSS v4.0 6.9 MEDIUM. This record keeps the CISA 5.8 value, matching the hunt skeleton, and notes the NVD scores here. Exploit status: CISA reports no known public exploitation, and no public exploit was found in the sources reviewed. Specific unprotected API endpoints are not disclosed in any source reviewed, so no endpoint-level IOCs can be given. No network IOCs (IPs/domains) exist for this vulnerability, so BeaconBeagle C2 correlation was not applicable.
Defender relevance: Tracer controllers are building automation/BMS devices and sit in OT networks, so exposure to the internet or flat IT networks is the main risk. A secondary source lists BACnet and ports 47808, 80 and 443 as relevant protocols/ports for the product family.
MITRE ATT&CK techniques used in TL-2026-3555
Collection
T1005 Data from Local System; T1602 Data from Configuration Repository
Execution
T1059 Command and Scripting Interpreter
Initial Access
Affected products and versions in CVE-2026-28254
- Trane — Tracer SC
Vulnerable versions: < v4.4_SP7
Fixed in: v4.4_SP7 - Trane — Tracer SC+
Vulnerable versions: < v6.3.2310
Fixed in: v6.30.2313 - Trane — Tracer Concierge
Vulnerable versions: < v6.3.2310
Remediation for CVE-2026-28254
Patches
- Upgrade Tracer SC+ to v6.30.2313 (fixes CVE-2026-28252, CVE-2026-28253, CVE-2026-28254)
- Upgrade Tracer SC to v4.4_SP7 or later (per secondary reporting; confirm with Trane)
- Apply the vendor's Tracer Concierge update; affected versions are earlier than v6.3.2310
Immediate actions
- Identify all Trane Tracer SC, Tracer SC+ and Tracer Concierge devices and confirm none are reachable from the internet
- Restrict network access to the controllers' web/API interfaces to trusted management hosts
Workarounds
- Place controllers behind a firewall and isolate them from untrusted networks until patched
- Follow CISA ICS defensive guidance for risk assessment before deploying mitigations
Longer-term hardening
- Segment building management/OT networks from IT and the internet
- Restrict remote access to patched VPN clients and monitor controller API access logs
CVEs associated with CVE-2026-28254
Weaknesses (CWE) in CVE-2026-28254
Timeline of CVE-2026-28254
- NVD lists CVE-2026-28254 as published (Missing Authorization, CWE-862; CVSS v3.1 7.5, v4.0 6.9)
- Trane fix available: Tracer SC+ v6.30.2313 addresses CVE-2026-28252, CVE-2026-28253 and CVE-2026-28254 (patch availability dated 3/12/2026 per Tenable)
- CISA releases ICS Advisory ICSA-26-071-01 covering CVE-2026-28252 through CVE-2026-28256 in Trane Tracer SC, SC+ and Concierge; researcher credit to Noam Moshe of Claroty
- Security Arsenal publishes analysis of the Trane Tracer advisory, citing CISA ICSA-26-071-01 and recommending upgrade plus network segmentation
- Tenable OT plugin 505314 for CVE-2026-28254 lists record published 4/7/2026
- Tenable OT plugin record for CVE-2026-28254 updated 4/8/2026; no known public exploits listed
Sources cited for CVE-2026-28254
- CISA ICS Advisory ICSA-26-071-01: Trane Tracer SC, Tracer SC+, Tracer Concierge
- Claroty Team82 Disclosure Dashboard - CVE-2026-28254
- NVD - CVE-2026-28254
- Tenable OT: Trane Tracer SC, Tracer SC+, and Tracer Concierge Missing Authorization (CVE-2026-28254)
- SentinelOne Vulnerability Database - CVE-2026-28254
- Action1 - CVE-2026-28254 Trane Tracer SC
- Security Arsenal - Critical Flaws in Trane Tracer Controllers Expose HVAC Systems
Detection coverage for TL-2026-3555
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3555 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.