CVE-2026-28256 is a hard-coded security-relevant constants flaw in Trane Tracer SC, Tracer SC+ and Tracer Concierge. NVD scores it 9.8 and CISA scores it 5.8. It could let an attacker disclose sensitive information and take over accounts. Trane says it has communicated new controls to its customers.
What's affected
CISA's advisory ICSA-26-071-01, released 12 March 2026, lists these affected versions:
- Trane Tracer SC: before v4.4_SP7
- Trane Tracer SC+: before v6.3.2310
- Trane Tracer Concierge: before v6.3.2310
CISA's remediation for this CVE is a vendor mitigation: Trane has implemented enhanced security controls which have been communicated to its customers, and for more information you should contact Trane. No fixed firmware version is listed for this CVE specifically.
CISA scores it 5.8 (Medium), and NVD scores it 9.8. The weakness is CWE-547 (Use of Hard-coded, Security-relevant Constants).
This is one of five CVEs in the same CISA advisory. If you already have a plan for the broader Tracer advisory, this one folds into it.
How to check if you're exposed
Inventory your Trane building automation controllers and read the firmware version for each Tracer SC, Tracer SC+ and Tracer Concierge unit from its management interface or from your building automation records. Compare against the versions in the CISA advisory.
Then check how each unit is reachable. Control devices should not be exposed to the internet. List which networks and remote access paths can reach them, and whether any are reachable from outside the building network.
What to do now
- Contact Trane, since CISA says the vendor has communicated the mitigation to its customers and directs others to contact Trane.
- Contact Trane or your service provider to confirm the firmware level on each affected controller and the upgrade path.
- Make sure no Tracer controller is reachable from the internet. Place them behind a firewall, isolated from business networks.
- Use a current VPN for any remote access, and remember a VPN is only as secure as the devices connecting to it.
- Follow CISA's recommended practices for control systems and review the advisory for updates.
Why it matters
A security-relevant constant is a fixed value that the product uses in a security decision, such as a key, a salt or a token seed. When the same value ships in every unit, it stops being a secret once anyone extracts it. The product behaves as designed, and the design is the problem.
The difference from the hard-coded credentials entry, CVE-2026-28255, is subtle. Credentials are used to log in. Constants are used inside protection mechanisms. Both lead to the same advisory summary: information disclosure and account takeover.
Fixes for this class are often not just a firmware swap. They may need keys to be generated per device or changes on the service side, which fits the vendor's wording about controls communicated to customers.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Where do I get the fix?
From Trane. CISA's advisory says the vendor has communicated enhanced security controls to customers and tells others to contact Trane.
What is the difference between this and CVE-2026-28255?
Both involve fixed secrets in the product. CVE-2026-28255 is hard-coded credentials, and this one is hard-coded security-relevant constants.
Sources
Last reviewed: 19 October 2026.
