CVE-2026-28253 Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

High 8.7 Published 12 Mar 2026 Updated 13 Mar 2026

An unauthenticated attacker can cause a denial-of-service condition in Trane Tracer SC, SC+, and Concierge systems via excessive memory allocation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-28253?

CVE-2026-28253 is a high-severity denial of service vulnerability in Trane Tracer Concierge, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition

Weakness: CWE-789

Which versions are affected by CVE-2026-28253?

It affects 3 products.

Products include Trane Tracer Concierge, Trane Tracer Sc\+ Firmware, Trane Tracer Sc Firmware.

How do I fix CVE-2026-28253?

No fix has been published for CVE-2026-28253 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-28253 being exploited?

There is no known exploitation of CVE-2026-28253 in the wild and no public exploit code.

Sources

Also known as GHSA-c7pr-383r-xgg3.