CVE-2026-28252: Trane Tracer SC Authentication Bypass to Root

CVE-2026-28252 is a risky cryptographic algorithm flaw in Trane Tracer SC, Tracer SC+ and Tracer Concierge building controllers. NVD scores it 9.8: an attacker could bypass authentication and gain root level access. CISA lists Tracer SC+ v6.30.2313 as the vendor fix, so contact Trane to schedule the upgrade.

What's affected

CISA's advisory ICSA-26-071-01, released 12 March 2026, lists these affected versions:

• Trane Tracer SC: before v4.4_SP7
• Trane Tracer SC+: before v6.3.2310
• Trane Tracer Concierge: before v6.3.2310

For this CVE, CISA's vendor fix entry reads: Trane has released Tracer SC+ version v6.30.2313 for users to upgrade to, and the same entry covers CVE-2026-28253 and CVE-2026-28254. The advisory does not list a separate fixed version for Tracer SC or Tracer Concierge, so ask Trane for the right release for your model.

CISA scores this CVE 8.1 using CVSS v3.0 with high attack complexity. NVD's number is 9.8. The advisory covers five CVEs in total: this one, CVE-2026-28253 (a denial of service), CVE-2026-28254 (missing authorization on unprotected APIs), CVE-2026-28255 and CVE-2026-28256. CISA's summary of the combined impact is information disclosure, arbitrary command execution or denial of service.

How to check if you're exposed

Inventory your Trane building automation controllers and read the firmware version for each Tracer SC, Tracer SC+ and Tracer Concierge unit from its management interface or from your building automation records. Compare against the versions in the CISA advisory.

Then check how each unit is reachable. Control devices should not be exposed to the internet. List which networks and remote access paths can reach them, and whether any are reachable from outside the building network.

What to do now

1. Contact Trane to confirm the firmware level on each unit and to get the fixed release for your model. CISA names Tracer SC+ v6.30.2313 as the vendor fix.
2. Schedule the upgrade during a maintenance window and keep a backup of controller configuration first.
3. Make sure no Tracer controller is reachable from the internet. Place them behind a firewall, isolated from business networks.
4. Use a current VPN for any remote access, and remember a VPN is only as secure as the devices connecting to it.
5. Follow CISA's recommended practices for control systems and review the advisory for updates.

Why it matters

The weakness is CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). Cryptography guards the login and the session. If the algorithm is weak, the guard looks real but can be defeated without ever knowing the password, which is what a bypass of authentication means here.

Root access is the ceiling for a device. A building controller sits between software and equipment such as heating, cooling and access systems, and compromising one can affect the building that depends on it. The advisory lists Critical Manufacturing as the sector and says the products are deployed worldwide.

The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog. As with most control system advisories, the most valuable control is network placement: keep the devices off the internet and behind a firewall, then patch on a planned schedule.

Quick check

Sources

• CISA ICS Advisory ICSA-26-071-01 (Trane Tracer SC, SC+ and Concierge)

Last reviewed: 19 October 2026.