# CVE-2026-28254: Missing Authorization in Trane Tracer SC, Tracer SC+ and Tracer Concierge Building Management Controllers

> A missing authorization flaw (CWE-862) in Trane Tracer SC, Tracer SC+ and Tracer Concierge building management systems lets an unauthenticated network attacker reach sensitive information through unprotected APIs. Fixed in Tracer SC+ v6.30.2313; no public exploitation reported to CISA.

- **Published:** 2026-10-14T21:48:46Z
- **Last reviewed:** 2026-10-14T21:48:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3555
- **ID:** TL-2026-3555
- **Severity:** MEDIUM (CVSS 5.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-28254

## Description

CVE-2026-28254 is a Missing Authorization vulnerability (CWE-862) in Trane Tracer SC, Tracer SC+ and Tracer Concierge. Per the CVE/NVD description, an unauthenticated attacker could access sensitive information through unprotected APIs. The Claroty Team82 disclosure page additionally lists possible consequences of sensitive data disclosure, command execution or denial of service; that wording comes from the Claroty summary and the primary CVE description only states information access.

The flaw was disclosed through CISA ICS Advisory ICSA-26-071-01 (released 2026-03-12, sector: Critical Manufacturing, worldwide deployment, vendor HQ Ireland). Credit goes to Noam Moshe of Claroty Team82. The advisory bundles five CVEs in the same product family: CVE-2026-28252 (broken cryptographic algorithm, CWE-327), CVE-2026-28253 (excessive memory allocation, CWE-789), CVE-2026-28254 (this issue), CVE-2026-28255 (hard-coded credentials, CWE-798) and CVE-2026-28256 (hard-coded security constants, CWE-547). Only CVE-2026-28254 is the subject of this record; the siblings are listed for context.

Affected versions per the CISA advisory: Tracer SC before v4.4_SP7, Tracer SC+ before v6.3.2310, and Tracer Concierge before v6.3.2310. Trane's fix for Tracer SC+ is v6.30.2313, which addresses CVE-2026-28252, CVE-2026-28253 and CVE-2026-28254. A secondary report (Security Arsenal) names Tracer SC v4.4_SP7 as the fixed Tracer SC release; this was not independently confirmed in the primary advisory text retrieved.

Scoring differs by source. The CISA advisory scores the issue CVSS 5.8 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). NVD records CVSS v3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CVSS v4.0 6.9 MEDIUM. This record keeps the CISA 5.8 value, matching the hunt skeleton, and notes the NVD scores here. Exploit status: CISA reports no known public exploitation, and no public exploit was found in the sources reviewed. Specific unprotected API endpoints are not disclosed in any source reviewed, so no endpoint-level IOCs can be given. No network IOCs (IPs/domains) exist for this vulnerability, so BeaconBeagle C2 correlation was not applicable.

Defender relevance: Tracer controllers are building automation/BMS devices and sit in OT networks, so exposure to the internet or flat IT networks is the main risk. A secondary source lists BACnet and ports 47808, 80 and 443 as relevant protocols/ports for the product family.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1602 Data from Configuration Repository
- T1005 Data from Local System
- T1059 Command and Scripting Interpreter

## Sources

- [CISA ICS Advisory ICSA-26-071-01: Trane Tracer SC, Tracer SC+, Tracer Concierge](https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-28254](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-28254)
- [NVD - CVE-2026-28254](https://nvd.nist.gov/vuln/detail/CVE-2026-28254)
- [Tenable OT: Trane Tracer SC, Tracer SC+, and Tracer Concierge Missing Authorization (CVE-2026-28254)](https://www.tenable.com/plugins/ot/505314)
- [SentinelOne Vulnerability Database - CVE-2026-28254](https://www.sentinelone.com/vulnerability-database/cve-2026-28254/)
- [Action1 - CVE-2026-28254 Trane Tracer SC](https://www.action1.com/vulnerabilities/cve-2026-28254/)
- [Security Arsenal - Critical Flaws in Trane Tracer Controllers Expose HVAC Systems](https://securityarsenal.com/blog/critical-flaws-in-trane-tracer-controllers-expose-hvac-systems-to-root-attacks)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3555