# CVE-2026-22877: Copeland XWEB / XWEB Pro Unauthenticated Arbitrary File Read (Path Traversal)

> An arbitrary file-read vulnerability in Copeland XWEB Pro 1.12.1 and prior (XWEB 300D PRO, 500D PRO, 500B PRO) lets unauthenticated network attackers read arbitrary files on the system and potentially cause a denial of service. CISA scores it 3.7 (Low) while NVD's primary score is 9.1; a fix is available by updating to the latest vendor release.

- **Published:** 2026-10-15T03:05:17Z
- **Last reviewed:** 2026-10-15T03:05:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3579
- **ID:** TL-2026-3579
- **Severity:** LOW (CVSS 3.7)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-22877, CVE-2026-21718

## Description

CVE-2026-22877 is an arbitrary file-read weakness (CWE-22, path traversal) in the web management software of Copeland XWEB Pro, version 1.12.1 and prior. It affects the XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO, which are commercial-facilities/refrigeration monitoring and control platforms deployed worldwide. An unauthenticated attacker with network reachability to the device can read arbitrary files on the system, and the advisory notes this can potentially cause a denial-of-service condition.

The flaw was reported by Amir Zaltzman and Noam Moshe of Claroty Team82 as one of 23 vulnerabilities in the same product line, published by CISA as ICSA-26-057-10 on 2026-02-26 and in NVD on 2026-02-27. The other 22 issues include two critical findings (CVE-2026-21718, CVSS 10.0, pre-authenticated code execution; CVE-2026-24663, CVSS 9.0, unauthenticated OS command injection), an authentication bypass (CVE-2026-25085, CVSS 8.6), a stack-based buffer overflow (CVE-2026-20797) and a large set of authenticated OS command injections (CWE-78). The CISA advisory states that exploitation of the set could allow authentication bypass, denial of service, memory corruption and arbitrary code execution. Defenders should treat the file read as one component of an exposed, multi-flaw attack surface, since it can be combined with the unauthenticated or authentication-bypass issues in the same advisory (analytic inference; no chained exploitation is documented in the sources).

Scoring differs by source. CISA (ICS-CERT) assigns CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N for 3.7 (Low). NVD's primary assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H for 9.1 (Critical), with CWE-22 as the secondary classification and NVD-CWE-noinfo as primary. The NVD record was last modified 2026-06-17.

No public proof-of-concept is cited in the sources, and CISA reports that no known public exploitation specifically targeting these vulnerabilities has been reported to it. The sources do not state a fixed version number; Copeland directs customers to update to the latest version via its System Software Update page or in-device through SYSTEM -> Updates | Network (requires internet access). No IOCs (hashes, IPs, domains) have been published, so detection must rely on behavioral monitoring of requests to the XWEB web interface.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1005 Data from Local System
- T1499.004 Application or System Exploitation

## Sources

- [CISA ICS Advisory ICSA-26-057-10: Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [Claroty Team82 Disclosure: CVE-2026-22877](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-22877)
- [Copeland System Software Update (vendor fix)](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)
- [NVD: CVE-2026-22877](https://nvd.nist.gov/vuln/detail/CVE-2026-22877)
- [INCIBE-CERT: Multiples vulnerabilidades en Copeland XWEB y XWEB Pro](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-copeland-xweb-y-xweb-pro)
- [NVD: CVE-2026-21718 (related critical XWEB Pro flaw)](https://nvd.nist.gov/vuln/detail/CVE-2026-21718)
- [CVE Program record: CVE-2026-21718](https://cveawg.mitre.org/api/cve/CVE-2026-21718)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3579