PatchTheCVEtrane vulnerabilities
Recent CVEs affecting trane products. 5 tracked.
trane has 5 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-03-12. Highest priority: CVE-2026-28255 (score 45/100).
- CVE-2026-28256 CRITICAL 9.8 UPGRADE UPGRADE A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Conc
- CVE-2026-28255 CRITICAL 9.8 UPGRADE UPGRADE A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow
- CVE-2026-28254 HIGH 7.5 UPGRADE UPGRADE A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unau
- CVE-2026-28253 HIGH 7.5 UPGRADE UPGRADE A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concier
- CVE-2026-28252 CRITICAL 9.8 UPGRADE UPGRADE A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Co
FAQ
How do I fix trane vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is trane being exploited right now?
None of the tracked trane CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which trane CVE should I patch first?
CVE-2026-28255 currently ranks highest (45/100): A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow.