CVE-2026-28255 is a hard-coded credentials flaw in Trane Tracer SC, Tracer SC+ and Tracer Concierge. NVD scores it 9.8, while CISA scores it 6.8. It could let an attacker disclose sensitive information and take over accounts. Trane says it mitigated this one with enhanced cloud security controls.
What's affected
CISA's advisory ICSA-26-071-01, released 12 March 2026, lists these affected versions:
- Trane Tracer SC: before v4.4_SP7
- Trane Tracer SC+: before v6.3.2310
- Trane Tracer Concierge: before v6.3.2310
The advisory's remediation for this CVE is a mitigation by the vendor, not a firmware version: Trane has implemented enhanced cloud security controls. The advisory does not describe what those controls are, and it does not say whether customers need to do anything. Treat the firmware upgrade path in the same advisory as part of your overall plan and ask Trane to confirm your status.
Scores differ. CISA lists 6.8 (Medium) with the vector showing high privileges required and a changed scope. NVD's score for the record is 9.8. The weakness is CWE-798 (Use of Hard-coded Credentials).
How to check if you're exposed
Inventory your Trane building automation controllers and read the firmware version for each Tracer SC, Tracer SC+ and Tracer Concierge unit from its management interface or from your building automation records. Compare against the versions in the CISA advisory.
Then check how each unit is reachable. Control devices should not be exposed to the internet. List which networks and remote access paths can reach them, and whether any are reachable from outside the building network.
What to do now
- Ask Trane to confirm in writing whether the cloud side mitigation covers your deployment and whether you need to take any action.
- Contact Trane or your service provider to confirm the firmware level on each affected controller and the upgrade path.
- Make sure no Tracer controller is reachable from the internet. Place them behind a firewall, isolated from business networks.
- Use a current VPN for any remote access, and remember a VPN is only as secure as the devices connecting to it.
- Follow CISA's recommended practices for control systems and review the advisory for updates.
- Review the accounts on your controllers and the cloud service connected to them, and remove any that are unused.
Why it matters
A hard-coded credential is a secret baked into the product. Every copy of the product holds the same secret, so anyone who learns it from one device can try it on all of them. Unlike a weak password, you cannot fix it by choosing a better one, because the user does not control it.
That is why the vendor's remediation here is on the vendor side, with controls in the cloud service. The advisory says the weakness could allow disclosure of sensitive information and account takeover.
The gap between NVD's 9.8 and CISA's 6.8 comes from the CISA vector, which requires high privileges. Read both: the high number tells you the worst case if those conditions are met, and the lower one tells you what the conditions cost.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is there a firmware version that fixes CVE-2026-28255?
The advisory lists a vendor mitigation, which is enhanced cloud security controls. It does not name a firmware version for this CVE. Confirm with Trane.
Why do NVD and CISA disagree on the score?
They used different vectors. CISA's requires high privileges and gives 6.8. NVD's does not and gives 9.8.
Sources
Last reviewed: 19 October 2026.
