Threat reportVulnerabilityTL-2026-3583
CVE-2026-20764: OS Command Injection in Copeland XWEB Pro (hostname configuration) enables authenticated RCE
CVE-2026-20764 (TL-2026-3583), also tracked as ICSA-26-057-10, is a high-severity software vulnerability scored CVSS 8, first published 2026-10-15. It has no confirmed attribution, affects Copeland XWEB 300D PRO, references 3 CVEs (CVE-2026-20764, CVE-2026-23702, CVE-2026-24695), maps to 3 MITRE ATT&CK techniques (T1059, T1078, T1190), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3583
- Threat ID
- TL-2026-3583
- Also known as
- ICSA-26-057-10
- Severity
- HIGH
- CVSS
- 8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- commercial facilities, retail, food and beverage, cold chain
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 8
How CVE-2026-20764 works
An OS command injection vulnerability (CWE-78) in Copeland XWEB Pro 1.12.1 and prior (XWEB 300D PRO, 500D PRO, 500B PRO) lets an authenticated attacker achieve remote code execution through malicious input in the device hostname configuration. CISA reports no known public exploitation; Copeland has released a fix.
CVE-2026-20764 is an OS command injection vulnerability in the web management platform of Copeland XWEB Pro, a refrigeration/HVAC monitoring and control product used in commercial facilities. Per the CVE record published by CISA (ICS-CERT CNA), XWEB Pro version 1.12.1 and prior is affected: an authenticated attacker can supply malicious input through the device hostname configuration, and that value is later processed during system setup, resulting in execution of attacker-controlled operating system commands on the device.
The flaw is one of 23 vulnerabilities in XWEB and XWEB Pro disclosed together in CISA advisory ICSA-26-057-10 (published 2026-02-26) and credited to Amir Zaltzman and Noam Moshe of Claroty Team82. 20 of the 23 are CWE-78 command injections in different features (examples named by Team82: the server username field of the import-preconfiguration action in the API V1 route, CVE-2026-23702; OpenSSL argument fields in the utility route, CVE-2026-24695). The advisory also lists higher-severity siblings, including CVE-2026-21718 (CVSS 10.0, broken cryptography), CVE-2026-24663 (CVSS 9.0, command injection) and CVE-2026-25085 (CVSS 8.6). CISA summarizes the combined impact as authentication bypass, denial of service, memory corruption and arbitrary code execution. Chaining an authentication-bypass sibling with this authenticated injection would raise practical risk, but that chain is not described in the cited sources.
Scoring differs by source: the CISA CNA vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (8.0 HIGH), while the NVD primary score is 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The exploit requires valid credentials and network reach to the XWEB Pro management interface. No public proof-of-concept and no in-the-wild exploitation are reported (CISA). The sources publish no network indicators, hashes or malware; defensible indicators are behavioral (shell metacharacters in the hostname field and anomalous child processes spawned by the management service).
Copeland has provided a fix. Users should update XWEB Pro to the latest version from the Copeland software update page, or, on an internet-connected device, via SYSTEM > Updates | Network. CISA recommends minimizing network exposure of control systems, placing them behind firewalls isolated from business networks, and using VPNs for remote access.
MITRE ATT&CK techniques used in TL-2026-3583
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
Privilege Escalation
Affected products and versions in CVE-2026-20764
- Copeland — XWEB 300D PRO
Vulnerable versions: <=1.12.1
Fixed in: Latest XWEB Pro release per Copeland software update page - Copeland — XWEB 500D PRO
Vulnerable versions: <=1.12.1
Fixed in: Latest XWEB Pro release per Copeland software update page - Copeland — XWEB 500B PRO
Vulnerable versions: <=1.12.1
Fixed in: Latest XWEB Pro release per Copeland software update page
Remediation for CVE-2026-20764
Patches
- Update XWEB Pro to the latest version from https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
- Internet-connected units can update from Copeland servers via SYSTEM > Updates | Network
Immediate actions
- Identify all Copeland XWEB 300D PRO, 500D PRO and 500B PRO units running firmware 1.12.1 or earlier
- Remove XWEB Pro management interfaces from direct internet exposure
- Audit and rotate XWEB Pro administrator and user credentials, since exploitation requires authentication
- Review device hostname settings for shell metacharacters or unexpected values
Workarounds
- Restrict management-interface access to trusted administrator hosts until patched
- Limit the number of accounts that can change device configuration
Longer-term hardening
- Place control systems behind firewalls isolated from business networks
- Use VPNs with MFA for any required remote access
- Apply defense-in-depth and monitor management-interface traffic and configuration changes
CVEs associated with CVE-2026-20764
Weaknesses (CWE) in CVE-2026-20764
Timeline of CVE-2026-20764
- CVE-2026-20764 reserved by CISA as ICS-CERT CNA
- CISA states no known public exploitation of these vulnerabilities had been reported to it
- Copeland provides a fix; users directed to the software update page or SYSTEM > Updates | Network
- CISA publishes ICSA-26-057-10 covering 23 vulnerabilities in Copeland XWEB and XWEB Pro, credited to Claroty Team82 researchers
- CVE-2026-20764 published with CWE-78 and CVSS 3.1 score 8.0 from the CNA
- NVD record last modified; NVD primary score listed as 8.8 HIGH alongside the CNA score of 8.0
Sources cited for CVE-2026-20764
- CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro
- Claroty Team82 Disclosure Dashboard - CVE-2026-20764
- Copeland System Software Update (vendor fix)
- NVD - CVE-2026-20764
- CVE Record CVE-2026-20764 (CISA ICS-CERT CNA)
- CISA CSAF - icsa-26-057-10
- Claroty Team82 - CVE-2026-23702 (sibling, import preconfiguration)
- Claroty Team82 - CVE-2026-24695 (sibling, OpenSSL utility route)
- Critical Vulnerabilities Found in Copeland XWEB Pro Refrigeration Controllers
Detection coverage for TL-2026-3583
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3583 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.