Researchers at Claroty recently found vulnerabilities in two products widely deployed in data centers: the network cards that connect Vertiv uninterruptible power supply (UPS) units to the network, and the Trane Tracer SC+ HVAC controller.

These flaws could have let an attacker bypass authentication, gain remote access, and take control of the device outright. From there, an attacker could disrupt power protection or cooling directly or use that foothold to reach further into the network and other connected systems.

Both vendors patched the flaws after disclosure, and there have been no reports of either vulnerability being exploited in an actual attack. While this is good news, it is not a reason to relax. A disclosed vulnerability, patched or not, still tells any attacker willing to study it exactly where to look.

A familiar pattern

Unfortunately, this is a familiar pattern. Vulnerabilities in building management systems surface regularly, and for good reason. Many of these systems trace their design back decades, built to work alongside mainframes and legacy controls instead of modern, digitally connected infrastructure. They also tend to run quietly in the background, so they get far less scrutiny than a laptop or a server, even though data centers and many other industrial companies depend on them to stay running.

The real story here is not the discovery itself, but what data center operators — as well as other companies using the same systems — can do to proactively address these vulnerabilities and make sure they’re fully protected.

The case for preparation

For data center operators with a comprehensive cybersecurity program already in place, a finding like this calls for attention, not alarm. That confidence comes down to two factors.

• First, preparation is not a single control, it is a program. Patch management and continuous vulnerability scanning are two clear examples. A mature program looks for weaknesses constantly across every connected system, building equipment included, and acts on them as soon as they surface. That discipline matters more now than it did five years ago, since AI has accelerated both the pace of attacks and the level of public scrutiny aimed at the industry.
• Second, layered protections around these systems, paired with a demonstrated incident response capability, close the gap that patching alone cannot. IBM’s Cost of a Data Breach Report found that attackers sit undetected inside a network for an average of 181 days. Data center operators with comprehensive security programs can cut that down to days or even hours. That gap determines whether a vulnerability becomes a headline or a footnote.

Where real exposure lies

Exposure is not evenly distributed across the industry. The AI boom has produced a wave of new, fast-built data centers racing to meet demand, and contrary to media reporting, many of those facilities are smaller and less mature from a security standpoint. At the same time, larger, established operators are not necessarily safer. Ownership changes, private equity investment, and new leadership can all introduce turnover and instability that can lead to vulnerabilities.

The exposure is also physical. Building infrastructure runs on ten-to-20-year lifecycles. Older facilities often contain a mix of modern digital controls and older, sometimes even analog equipment. Even in new construction, the core function, whether that is cooling air or regulating power, gets the attention from engineering.

This kind of equipment also carries a heavy cost and an outsized physical footprint. Cooling and power systems represent a serious capital investment, and mechanical rooms are often designed and built around one specific unit rather than a generic slot. Swapping that unit out early means significant expense and disruption, so operators tend to run it as long as they possibly can, sometimes years past the point a typical IT asset would already be retired.

Put those pieces together: uneven security maturity across the industry, equipment designed for an analog era, and hardware stretched years past a normal replacement cycle. That combination creates exactly the kind of gap researchers keep finding, and attackers love to exploit.

What’s actually at stake

Failure of physical or logical (network and systems) security controls can show up fast. An unplanned UPS failure without a redundant power path immediately triggers alarms and an operational response. HVAC risk is more subtle, but the potential impact may be greater. Shifting temperature or humidity by only a few degrees raises the risk of static discharge, which can damage compute equipment before anyone notices a problem. Cut off cooling entirely, and internal temperatures can climb past 120 degrees Fahrenheit within minutes, the threshold where permanent damage begins. Push past 130 and recovery is unlikely.

A compromised network card carries a different kind of risk. Some building management devices keep a cellular or modem connection as a fallback, so they stay reachable even if the primary network goes down. An attacker who reaches one of these cards can use it as a foothold to pivot toward other systems, from security cameras to access control to broader network segments well beyond the original device.

Building resilience into the plan

Fundamentals still matter, but they are not enough on their own. Every operator also needs a workable Plan B, which means knowing how to physically disconnect a compromised device — whether that means pulling a cable or isolating a network card — while keeping the underlying equipment running through a direct or local connection. Know how to restart critical systems into a safe default mode so operations continue while the issue gets addressed separately.

That kind of resilience matters regardless of the cause. For example, during a project connecting HVAC systems between a new building and an existing one at a data center campus, an installer issued a timed shutdown command intended only for the new building's untested units. The command reached the existing building too, and HVAC went offline after hours.

The initial response treated it as a possible attack until the investigation confirmed human error. Backup procedures and a practiced response restored service quickly with minimal impact, which is the point: resilience and a strong recovery capability protected operations whether the trigger is a bad actor or a mistyped command.

A risk profile unlike most

Data centers carry a risk profile most enterprises do not share. They hold digital assets and sensitive data, and they also operate the physical machinery that keeps that data accessible. A vulnerability in a network card or a building controller threatens both sides of that equation at once.

The operators who maintain vigilance, patch consistently, monitor continuously, and rehearse their response plans are the ones who will treat findings like this one as routine rather than alarming.