Threat reportVulnerabilityTL-2026-3579
CVE-2026-22877: Copeland XWEB / XWEB Pro Unauthenticated Arbitrary File Read (Path Traversal)
CVE-2026-22877 (TL-2026-3579), also tracked as ICSA-26-057-10, is a low-severity software vulnerability scored CVSS 3.7, first published 2026-10-15. It has no confirmed attribution, affects Copeland XWEB 300D PRO, references 2 CVEs (CVE-2026-22877, CVE-2026-21718), maps to 3 MITRE ATT&CK techniques (T1005, T1190, T1499.004), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 3.7/10Low
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3579
- Threat ID
- TL-2026-3579
- Also known as
- ICSA-26-057-10
- Severity
- LOW
- CVSS
- 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- commercial facilities, retail, food service, cold chain
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 9
How CVE-2026-22877 works
An arbitrary file-read vulnerability in Copeland XWEB Pro 1.12.1 and prior (XWEB 300D PRO, 500D PRO, 500B PRO) lets unauthenticated network attackers read arbitrary files on the system and potentially cause a denial of service. CISA scores it 3.7 (Low) while NVD's primary score is 9.1; a fix is available by updating to the latest vendor release.
CVE-2026-22877 is an arbitrary file-read weakness (CWE-22, path traversal) in the web management software of Copeland XWEB Pro, version 1.12.1 and prior. It affects the XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO, which are commercial-facilities/refrigeration monitoring and control platforms deployed worldwide. An unauthenticated attacker with network reachability to the device can read arbitrary files on the system, and the advisory notes this can potentially cause a denial-of-service condition.
The flaw was reported by Amir Zaltzman and Noam Moshe of Claroty Team82 as one of 23 vulnerabilities in the same product line, published by CISA as ICSA-26-057-10 on 2026-02-26 and in NVD on 2026-02-27. The other 22 issues include two critical findings (CVE-2026-21718, CVSS 10.0, pre-authenticated code execution; CVE-2026-24663, CVSS 9.0, unauthenticated OS command injection), an authentication bypass (CVE-2026-25085, CVSS 8.6), a stack-based buffer overflow (CVE-2026-20797) and a large set of authenticated OS command injections (CWE-78). The CISA advisory states that exploitation of the set could allow authentication bypass, denial of service, memory corruption and arbitrary code execution. Defenders should treat the file read as one component of an exposed, multi-flaw attack surface, since it can be combined with the unauthenticated or authentication-bypass issues in the same advisory (analytic inference; no chained exploitation is documented in the sources).
Scoring differs by source. CISA (ICS-CERT) assigns CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N for 3.7 (Low). NVD's primary assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H for 9.1 (Critical), with CWE-22 as the secondary classification and NVD-CWE-noinfo as primary. The NVD record was last modified 2026-06-17.
No public proof-of-concept is cited in the sources, and CISA reports that no known public exploitation specifically targeting these vulnerabilities has been reported to it. The sources do not state a fixed version number; Copeland directs customers to update to the latest version via its System Software Update page or in-device through SYSTEM -> Updates | Network (requires internet access). No IOCs (hashes, IPs, domains) have been published, so detection must rely on behavioral monitoring of requests to the XWEB web interface.
MITRE ATT&CK techniques used in TL-2026-3579
Collection
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in CVE-2026-22877
- Copeland — XWEB 300D PRO
Vulnerable versions: <=1.12.1
Fixed in: Latest vendor release (version not stated) - Copeland — XWEB 500D PRO
Vulnerable versions: <=1.12.1
Fixed in: Latest vendor release (version not stated) - Copeland — XWEB 500B PRO
Vulnerable versions: <=1.12.1
Fixed in: Latest vendor release (version not stated)
Remediation for CVE-2026-22877
Patches
- Latest XWEB Pro version from https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate (fixed version number not stated in sources)
Immediate actions
- Update XWEB 300D PRO, 500D PRO and 500B PRO to the latest Copeland software release
- Remove XWEB Pro web interfaces from direct internet exposure and restrict access to trusted management networks
- Review web server access logs for path-traversal sequences against the management interface
Workarounds
- In-device update via SYSTEM -> Updates | Network (requires internet access)
- Restrict network reachability to the device until updated
Longer-term hardening
- Place OT/commercial-facilities devices behind firewalls isolated from business networks
- Use secure remote access methods such as VPN, kept up to date, for any required remote access
- Perform impact analysis and risk assessment before deploying defensive measures, per CISA ICS guidance
CVEs associated with CVE-2026-22877
Weaknesses (CWE) in CVE-2026-22877
Timeline of CVE-2026-22877
- CISA reported no known public exploitation specifically targeting these vulnerabilities.
- Copeland remediation guidance referenced: update to the latest version via the System Software Update page or in-device SYSTEM -> Updates | Network.
- Vulnerabilities credited to Claroty Team82 researchers (Amir Zaltzman named in the CISA advisory; Noam Moshe also reported as co-reporter).
- CISA released ICS advisory ICSA-26-057-10 covering 23 vulnerabilities in Copeland XWEB and XWEB Pro, including CVE-2026-22877 (CVSS 3.7, CWE-22).
- CVE-2026-22877 published in NVD with ICS-CERT secondary score 3.7 (Low) and NVD primary score 9.1 (Critical).
- NVD record for CVE-2026-22877 last modified.
Sources cited for CVE-2026-22877
- CISA ICS Advisory ICSA-26-057-10: Copeland XWEB and XWEB Pro
- Claroty Team82 Disclosure: CVE-2026-22877
- Copeland System Software Update (vendor fix)
- NVD: CVE-2026-22877
- INCIBE-CERT: Multiples vulnerabilidades en Copeland XWEB y XWEB Pro
- NVD: CVE-2026-21718 (related critical XWEB Pro flaw)
- CVE Program record: CVE-2026-21718
Detection coverage for TL-2026-3579
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3579 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.