Threat reportVulnerabilityTL-2026-3577
CVE-2026-3037: OS Command Injection in Copeland XWEB Pro (MBird SMS service) enabling authenticated RCE
CVE-2026-3037 (TL-2026-3577), also tracked as ICSA-26-057-10, is a high-severity software vulnerability scored CVSS 8, first published 2026-10-15. It has no confirmed attribution, affects Copeland XWEB 300D PRO, references 3 CVEs (CVE-2026-3037, CVE-2026-21718, CVE-2026-25085), maps to 5 MITRE ATT&CK techniques (T0807, T0859, T1059), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3577
- Threat ID
- TL-2026-3577
- Also known as
- ICSA-26-057-10
- Severity
- HIGH
- CVSS
- 8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- commercial-facilities, building-management, cold-chain-refrigeration, operational-technology
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-3037 works
An OS command injection flaw (CWE-78) in Copeland XWEB Pro 1.12.1 and prior (XWEB 300D PRO, 500D PRO, 500B PRO) lets an authenticated attacker achieve remote code execution via malicious input in the MBird SMS service URL and/or code set through the utility route. Copeland has released a fix; no public exploitation has been reported to CISA.
CVE-2026-3037 is an OS command injection vulnerability (CWE-78) in the web management interface of Copeland XWEB Pro, a commercial-facilities controller/monitoring platform. In versions 1.12.1 and prior, an authenticated attacker can supply malicious input to the MBird SMS service URL and/or code fields through the utility route. The stored value is not neutralized and is later processed during system setup, resulting in execution of attacker-controlled operating-system commands, i.e. remote code execution on the appliance.
The flaw was reported to CISA by Amir Zaltzman and Noam Moshe of Claroty Team82 and is one of 23 CVEs covered by CISA ICS advisory ICSA-26-057-10 (released 2026-02-26) for XWEB / XWEB Pro. The same advisory covers a pre-authenticated code-execution authentication bypass (CVE-2026-21718, CVSS 10.0), another authentication bypass (CVE-2026-25085, CVSS 8.6), numerous sibling authenticated command injections in other routes (for example the templates route, import-preconfiguration action, devices route and the Modbus command tool) and a path traversal and a stack buffer overflow. Because authentication-bypass flaws exist in the same product, the authentication requirement of CVE-2026-3037 should not be treated as a strong barrier on unpatched devices.
Scoring differs by source: CISA/Claroty list CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), which is also the NVD secondary score; the NVD primary score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). NVD published the CVE on 2026-02-27. CISA states no known public exploitation specifically targeting these vulnerabilities has been reported. No public PoC or threat-actor attribution is stated in any source.
Remediation: update XWEB Pro to the latest version from Copeland's software update page, or, from an internet-connected device, via SYSTEM > Updates | Network. Affected sector per CISA: Commercial Facilities, deployed worldwide.
MITRE ATT&CK techniques used in TL-2026-3577
Execution
T0807 Command-Line Interface; T1059 Command and Scripting Interpreter
persistence
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
Affected products and versions in CVE-2026-3037
- Copeland — XWEB 300D PRO
Vulnerable versions: <= 1.12.1
Fixed in: Latest XWEB Pro release via Copeland software update - Copeland — XWEB 500D PRO
Vulnerable versions: <= 1.12.1
Fixed in: Latest XWEB Pro release via Copeland software update - Copeland — XWEB 500B PRO
Vulnerable versions: <= 1.12.1
Fixed in: Latest XWEB Pro release via Copeland software update
Remediation for CVE-2026-3037
Patches
- Download the latest XWEB Pro software from https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
- Or update from an internet-connected device via SYSTEM > Updates | Network
Immediate actions
- Update Copeland XWEB 300D PRO, 500D PRO and 500B PRO to the latest XWEB Pro version (fixed release later than 1.12.1)
- Restrict network access to the XWEB Pro web management interface to trusted management hosts only
- Review and rotate XWEB Pro administrative and user credentials, and remove unused accounts
Workarounds
- If patching is delayed, limit authenticated users to the minimum necessary and block access from untrusted networks
Longer-term hardening
- Do not expose OT/building-management web interfaces directly to the internet; place them behind a VPN and firewall segmentation
- Monitor XWEB Pro configuration changes, in particular the MBird SMS service URL/code settings
CVEs associated with CVE-2026-3037
Weaknesses (CWE) in CVE-2026-3037
Timeline of CVE-2026-3037
- CISA scopes affected products to XWEB 300D PRO, 500D PRO and 500B PRO at version 1.12.1 and prior; sector Commercial Facilities, deployed worldwide; CSAF initial release (revision 1) published.
- Advisory also lists CVE-2026-24663 (CVSS 9.0, libraries route) and CVE-2026-24695 (CVSS 8.0, OpenSSL arguments) plus 17 further 8.0-rated OS command injections, CVE-2026-22877 (path traversal, 3.7) and CVE-2026-20797 (stack buffer overflow, 4.3).
- Same advisory discloses CVE-2026-21718 (CVSS 10.0, CWE-327, pre-authenticated code execution via authentication bypass) and CVE-2026-25085 (CVSS 8.6, CWE-394, authentication bypass via unexpected status code), which can remove the authentication prerequisite of CVE-2026-3037.
- CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to CISA.
- Advisory directs users to update XWEB Pro to the latest version via the Copeland software update page or SYSTEM > Updates | Network.
- CISA releases ICS advisory ICSA-26-057-10 covering 23 CVEs in Copeland XWEB / XWEB Pro <= 1.12.1, including CVE-2026-3037 (CVSS 8.0, CWE-78); researchers Amir Zaltzman and Noam Moshe of Claroty Team82 credited.
- NVD references list the CISA CSAF record, the CISA advisory and the Copeland update page as the authoritative remediation sources.
- NVD publishes CVE-2026-3037 with CWE-78; secondary CVSS 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) and primary CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Sources cited for CVE-2026-3037
- Claroty Team82 Disclosure Dashboard - CVE-2026-3037
- CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro
- Copeland XWEB Pro System Software Update (vendor fix)
- NVD - CVE-2026-3037
- CISA CSAF file icsa-26-057-10
- INCIBE-CERT early warning - CVE-2026-3037
- Claroty Team82 - CVE-2026-21718 (XWEB Pro authentication bypass, same advisory)
- Claroty Team82 - CVE-2026-25085 (XWEB Pro authentication bypass, same advisory)
Detection coverage for TL-2026-3577
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3577 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.