Threat reportICS/SCADATL-2026-3567
CVE-2026-28252 - Trane Tracer SC/SC+/Concierge Broken Cryptographic Algorithm Authentication Bypass
CVE-2026-28252 (TL-2026-3567), also tracked as ICSA-26-071-01, is a high-severity ICS/SCADA threat scored CVSS 8.1, first published 2026-10-15. It has no confirmed attribution, affects Trane Tracer SC, references 1 CVE (CVE-2026-28252), maps to 3 MITRE ATT&CK techniques (T1059, T1078, T1190), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 8.1/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3567
- Threat ID
- TL-2026-3567
- Also known as
- ICSA-26-071-01
- Severity
- HIGH
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- critical manufacturing, building automation, commercial facilities, data centers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How CVE-2026-28252 works
CVE-2026-28252 is a use of a broken or risky cryptographic algorithm (CWE-327) in Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers. It lets an attacker bypass authentication and obtain root-level access to the device. CISA reports no known public exploitation at publication.
CVE-2026-28252 affects Trane Tracer SC, Tracer SC+ and Tracer Concierge building-automation controllers and is tracked by CISA in ICS Advisory ICSA-26-071-01 (released 2026-03-12). The flaw is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). Per the CVE record, an attacker can bypass authentication and gain root-level access to the device. Per Claroty Team82, consequences include sensitive information disclosure, arbitrary command execution or denial of service.
Scoring differs by source. CISA and Claroty list CVSS v3 8.1 HIGH (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the high attack complexity reflecting the cryptographic weakness that must be defeated. NVD and Tenable list CVSS v3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.2 (AV:N/AC:H/AT:P). This record uses the CISA/Claroty 8.1 value. The public sources reviewed do not publish the specific algorithm weakness or an exploit procedure, and no PoC is referenced.
Affected versions per CISA: Tracer SC before v4.4_SP7, and Tracer SC+ and Tracer Concierge before v6.3.2310. The advisory names Tracer SC+ v6.30.2313 as the fixed release that addresses CVE-2026-28252, CVE-2026-28253 and CVE-2026-28254. The same advisory covers CVE-2026-28253 (memory allocation overflow, DoS, CVSS 7.5), CVE-2026-28254 (missing authorization, 5.8), CVE-2026-28255 (hard-coded credentials, 6.8) and CVE-2026-28256 (hard-coded security constants, 5.8). The vulnerability was reported by Noam Moshe of Claroty Team82. CISA lists the Critical Manufacturing sector. CISA states that no known public exploitation specifically targeting these vulnerabilities has been reported to it.
CISA mitigations: network isolation of controllers, VPN for remote access, firewall protection and Trane cloud security controls. Secondary reporting suggests monitoring BACnet (UDP 47808) and HTTP/HTTPS (80/443) access to controllers from unauthorized subnets, and watching for communication gaps or device unresponsiveness as DoS indicators. That guidance comes from a secondary blog, not the advisory. The sources do not provide network IOCs, malware, or actor attribution, so no BeaconBeagle correlation applies.
MITRE ATT&CK techniques used in TL-2026-3567
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
Defense Evasion
Initial Access
Affected products and versions in CVE-2026-28252
- Trane — Tracer SC
Vulnerable versions: < v4.4_SP7
Fixed in: v4.4_SP7 - Trane — Tracer SC+
Vulnerable versions: < v6.3.2310
Fixed in: v6.30.2313 - Trane — Tracer Concierge
Vulnerable versions: < v6.3.2310
Fixed in: v6.30.2313
Remediation for CVE-2026-28252
Patches
- Tracer SC+ v6.30.2313 (fixes CVE-2026-28252, CVE-2026-28253, CVE-2026-28254)
- Tracer SC v4.4_SP7 or later per CISA affected-version boundary
Immediate actions
- Upgrade Tracer SC+ and Tracer Concierge to v6.30.2313 or later; upgrade Tracer SC to v4.4_SP7 or later
- Remove controllers from direct internet exposure and isolate them behind firewalls
- Verify by port scan that controllers are not reachable from the internet or the corporate network
Workarounds
- Enable Trane cloud security controls per CISA advisory ICSA-26-071-01
- Restrict network access to controller management interfaces
Longer-term hardening
- Segment building-automation/OT networks onto dedicated VLANs
- Provide remote access only through patched VPNs
- Monitor BACnet and web-management traffic to controllers from unauthorized subnets
CVEs associated with CVE-2026-28252
Weaknesses (CWE) in CVE-2026-28252
Timeline of CVE-2026-28252
- CISA states no known public exploitation targeting these vulnerabilities has been reported to it
- Vulnerability credited to Noam Moshe of Claroty Team82 in the CISA advisory; Team82 lists it on its disclosure dashboard
- Fixed firmware made available; Tracer SC+ v6.30.2313 addresses CVE-2026-28252, CVE-2026-28253 and CVE-2026-28254 (patch date per Tenable/CISA)
- CVE-2026-28252 is published to NVD; NVD lists CVSS v3.1 9.8 and CVSS v4.0 9.2, CWE-327
- CISA publishes ICS Advisory ICSA-26-071-01 covering CVE-2026-28252 through CVE-2026-28256 in Trane Tracer SC, SC+ and Concierge; CVE-2026-28252 is rated CVSS v3 8.1 HIGH
- Tenable publishes OT Security plugin 505312 to detect vulnerable Trane Tracer devices for CVE-2026-28252
Sources cited for CVE-2026-28252
- Claroty Team82 Disclosure Dashboard - CVE-2026-28252
- CISA ICS Advisory ICSA-26-071-01 - Trane Tracer SC, SC+, Concierge
- NVD - CVE-2026-28252
- Tenable OT Security plugin 505312 - Trane Tracer CVE-2026-28252
- Security Arsenal - Critical Flaws in Trane Tracer Controllers Expose HVAC Systems to Root Attacks
- SentinelOne Vulnerability Database - CVE-2026-28252
- Action1 - CVE-2026-28252 Trane Tracer SC
- MITRE CVE Record - CVE-2026-28252
Detection coverage for TL-2026-3567
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3567 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.