Threat reportVulnerabilityTL-2026-3561
CVE-2026-28253: Trane Tracer SC, Tracer SC+ and Tracer Concierge Memory Allocation with Excessive Size Value (Unauthenticated DoS)
CVE-2026-28253 (TL-2026-3561), also tracked as ICSA-26-071-01, is a high-severity software vulnerability scored CVSS 7.5, first published 2026-10-14. It has no confirmed attribution, affects Trane Tracer SC, references 2 CVEs (CVE-2026-28253, CVE-2026-28252), maps to 3 MITRE ATT&CK techniques (T0814, T1190, T1499.004), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 7.5/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3561
- Threat ID
- TL-2026-3561
- Also known as
- ICSA-26-071-01
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- building automation, data centers, commercial real estate, critical manufacturing
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in CVE-2026-28253
Malware and tooling: Tenable OT Security plugin 505313
How CVE-2026-28253 works
CVE-2026-28253 is an unauthenticated, network-reachable denial-of-service flaw (CWE-789) in the HTTP/BACnet server of Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers. Claroty Team82 found it; Trane fixed it in Tracer SC+ v6.30.2313 and CISA published ICSA-26-071-01 on 2026-03-12. No public exploitation was reported.
CVE-2026-28253 is a 'Memory Allocation with Excessive Size Value' vulnerability (CWE-789) in Trane Tracer SC, Tracer SC+ and Tracer Concierge. An unauthenticated remote attacker can cause a denial-of-service condition. NVD scores it CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and CVSS 4.0 8.7 HIGH. CISA's advisory lists the same flaw with a CVSS 3.0 vector of the same shape.
Technical mechanism (per the Team82 research as summarized by trade press): the affected HTTP and BACnet server does not limit HTTP header size and keeps allocating memory while it receives data that contains no newline characters. A single network-reachable client can therefore push the controller toward resource exhaustion and disrupt the service. SentinelOne's summary similarly describes requests that make the system try to allocate memory blocks far exceeding available resources. Public sources do not name the exact port or protocol, and no public proof-of-concept is documented.
The flaw is one of five vulnerabilities Claroty Team82 reported (researcher credited by CISA: Noam Moshe) in the Tracer family, covered by CISA ICSA-26-071-01: CVE-2026-28252 (broken cryptographic algorithm in the Trane Diagnostic Service; deterministic challenge-response; root shell if SSH is manually enabled), CVE-2026-28253 (this DoS), CVE-2026-28254 (unauthenticated API routes disclosing device information), CVE-2026-28255 (hard-coded remote-service credentials shared across devices) and CVE-2026-28256 (hard-coded encryption constants for configuration, backups and firmware updates). Trane fixed CVE-2026-28252/28253/28254 in Tracer SC+ v6.30.2313; the other two were addressed with cloud-side security controls.
Affected: Tracer SC firmware before v4.4 SP7, and Tracer SC+ and Tracer Concierge before v6.3.2310 (the Claroty dashboard lists all versions as affected and recommends v6.30.2313 for Tracer SC+). CISA reported no known public exploitation at publication time. Tenable and SentinelOne also list no known exploits. These controllers are HVAC/building-management devices, including in data centers, so loss of availability can affect facility operations. Defenders should patch, keep the controllers off the public internet, and monitor for oversized or newline-free HTTP headers and repeated crashes or restarts of the Tracer web service.
MITRE ATT&CK techniques used in TL-2026-3561
Inhibit Response Function
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in CVE-2026-28253
- Trane — Tracer SC
Vulnerable versions: < v4.4 SP7
Fixed in: v4.4 SP7 - Trane — Tracer SC+
Vulnerable versions: < v6.3.2310
Fixed in: v6.30.2313 - Trane — Tracer Concierge
Vulnerable versions: < v6.3.2310
Fixed in: v6.3.2310
Remediation for CVE-2026-28253
Patches
- Trane Tracer SC+ v6.30.2313 (fixes CVE-2026-28252, CVE-2026-28253, CVE-2026-28254)
- Tracer SC v4.4 SP7 and Tracer SC+ / Concierge v6.3.2310 are the first non-vulnerable versions per NVD CPEs
Immediate actions
- Upgrade Tracer SC+ to v6.30.2313
- Upgrade Tracer SC to v4.4 SP7 or later, and Tracer SC+ / Tracer Concierge to v6.3.2310 or later
- Remove Tracer controllers from direct internet exposure
Workarounds
- Isolate systems from the public internet
- Disable optional remote-access services
- Place a reverse proxy or firewall in front of the controller web interface that enforces HTTP header size limits
Longer-term hardening
- Segment building-automation and BACnet networks from IT and untrusted networks
- Monitor Tracer web/BACnet service availability and HTTP header sizes at a reverse proxy or IDS
- Use Tenable OT Security plugin 505313 or an equivalent asset and vulnerability check to find affected controllers
CVEs associated with CVE-2026-28253
Weaknesses (CWE) in CVE-2026-28253
Timeline of CVE-2026-28253
- Trane Tracer firmware v6.3 released (per RefIndustry), the first release line containing fixes for the Team82-reported issues
- CVE-2026-28253 published in NVD with CVSS 3.1 7.5 HIGH, CVSS 4.0 8.7 HIGH, CWE-789
- Trane Tracer SC+ v6.30.2313 available, addressing CVE-2026-28252, CVE-2026-28253 and CVE-2026-28254
- CISA publishes ICSA-26-071-01 covering CVE-2026-28252 through CVE-2026-28256 in Trane Tracer SC, SC+ and Concierge; credits Noam Moshe of Claroty
- SentinelOne vulnerability database lists CVE-2026-28253 with no known public exploits
- Tenable OT Security plugin 505313 published to detect CVE-2026-28253 (updated 2026-04-08)
Sources cited for CVE-2026-28253
- Claroty Team82 Disclosure Dashboard - CVE-2026-28253
- CISA ICS Advisory ICSA-26-071-01 - Trane Tracer SC, Tracer SC+, and Tracer Concierge
- NVD - CVE-2026-28253
- Tenable OT Security plugin 505313 - Trane Tracer Memory Allocation with Excessive Size Value (CVE-2026-28253)
- SentinelOne Vulnerability Database - CVE-2026-28253
- Danfoss, Copeland and Trane address controller security vulnerabilities (RefIndustry)
- Claroty Team82 Disclosure Dashboard - CVE-2026-28252 (companion Tracer vulnerability)
- Action1 - CVE-2026-28253 Trane Tracer SC
Detection coverage for TL-2026-3561
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3561 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.