CVE-2026-28253

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-789

Affected software

Vendor	Product	Versions
Trane	Tracer SC	< v4.4 SP7
Trane	Tracer SC+	< v6.3.2310
Trane	Tracer Concierge	< v6.3.2310

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01Third Party Advisory, US Government Resource

Timeline

Published: Mar 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-282547.5A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access CVE-2026-282559.8A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensi CVE-2026-282569.8A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker CVE-2026-28264.3The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up CVE-2026-282615.5Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Inse CVE-2026-282626.0Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A lo CVE-2026-282634.8Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release ver CVE-2026-282645.5Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability CVE-2026-282657.1PowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged attacker with local access could potentially explo CVE-2026-282676.8Multiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwritten in the system di CVE-2026-282689.8Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the pa CVE-2026-282698.8Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authen