# CVE-2026-3037: OS Command Injection in Copeland XWEB Pro (MBird SMS service) enabling authenticated RCE

> An OS command injection flaw (CWE-78) in Copeland XWEB Pro 1.12.1 and prior (XWEB 300D PRO, 500D PRO, 500B PRO) lets an authenticated attacker achieve remote code execution via malicious input in the MBird SMS service URL and/or code set through the utility route. Copeland has released a fix; no public exploitation has been reported to CISA.

- **Published:** 2026-10-15T02:36:46Z
- **Last reviewed:** 2026-10-15T02:36:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3577
- **ID:** TL-2026-3577
- **Severity:** HIGH (CVSS 8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3037, CVE-2026-21718, CVE-2026-25085

## Description

CVE-2026-3037 is an OS command injection vulnerability (CWE-78) in the web management interface of Copeland XWEB Pro, a commercial-facilities controller/monitoring platform. In versions 1.12.1 and prior, an authenticated attacker can supply malicious input to the MBird SMS service URL and/or code fields through the utility route. The stored value is not neutralized and is later processed during system setup, resulting in execution of attacker-controlled operating-system commands, i.e. remote code execution on the appliance.

The flaw was reported to CISA by Amir Zaltzman and Noam Moshe of Claroty Team82 and is one of 23 CVEs covered by CISA ICS advisory ICSA-26-057-10 (released 2026-02-26) for XWEB / XWEB Pro. The same advisory covers a pre-authenticated code-execution authentication bypass (CVE-2026-21718, CVSS 10.0), another authentication bypass (CVE-2026-25085, CVSS 8.6), numerous sibling authenticated command injections in other routes (for example the templates route, import-preconfiguration action, devices route and the Modbus command tool) and a path traversal and a stack buffer overflow. Because authentication-bypass flaws exist in the same product, the authentication requirement of CVE-2026-3037 should not be treated as a strong barrier on unpatched devices.

Scoring differs by source: CISA/Claroty list CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), which is also the NVD secondary score; the NVD primary score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). NVD published the CVE on 2026-02-27. CISA states no known public exploitation specifically targeting these vulnerabilities has been reported. No public PoC or threat-actor attribution is stated in any source.

Remediation: update XWEB Pro to the latest version from Copeland's software update page, or, from an internet-connected device, via SYSTEM > Updates | Network. Affected sector per CISA: Commercial Facilities, deployed worldwide.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T0859 Valid Accounts
- T0807 Command-Line Interface

## Sources

- [Claroty Team82 Disclosure Dashboard - CVE-2026-3037](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-3037)
- [CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [Copeland XWEB Pro System Software Update (vendor fix)](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)
- [NVD - CVE-2026-3037](https://nvd.nist.gov/vuln/detail/CVE-2026-3037)
- [CISA CSAF file icsa-26-057-10](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json)
- [INCIBE-CERT early warning - CVE-2026-3037](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2026-3037)
- [Claroty Team82 - CVE-2026-21718 (XWEB Pro authentication bypass, same advisory)](https://claroty.com/team82/disclosure-dashboard/cve-2026-21718)
- [Claroty Team82 - CVE-2026-25085 (XWEB Pro authentication bypass, same advisory)](https://claroty.com/team82/disclosure-dashboard/cve-2026-25085)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3577