# CVE-2026-20764: OS Command Injection in Copeland XWEB Pro (hostname configuration) enables authenticated RCE

> An OS command injection vulnerability (CWE-78) in Copeland XWEB Pro 1.12.1 and prior (XWEB 300D PRO, 500D PRO, 500B PRO) lets an authenticated attacker achieve remote code execution through malicious input in the device hostname configuration. CISA reports no known public exploitation; Copeland has released a fix.

- **Published:** 2026-10-15T03:53:09Z
- **Last reviewed:** 2026-10-15T03:53:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3583
- **ID:** TL-2026-3583
- **Severity:** HIGH (CVSS 8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20764, CVE-2026-23702, CVE-2026-24695

## Description

CVE-2026-20764 is an OS command injection vulnerability in the web management platform of Copeland XWEB Pro, a refrigeration/HVAC monitoring and control product used in commercial facilities. Per the CVE record published by CISA (ICS-CERT CNA), XWEB Pro version 1.12.1 and prior is affected: an authenticated attacker can supply malicious input through the device hostname configuration, and that value is later processed during system setup, resulting in execution of attacker-controlled operating system commands on the device.

The flaw is one of 23 vulnerabilities in XWEB and XWEB Pro disclosed together in CISA advisory ICSA-26-057-10 (published 2026-02-26) and credited to Amir Zaltzman and Noam Moshe of Claroty Team82. 20 of the 23 are CWE-78 command injections in different features (examples named by Team82: the server username field of the import-preconfiguration action in the API V1 route, CVE-2026-23702; OpenSSL argument fields in the utility route, CVE-2026-24695). The advisory also lists higher-severity siblings, including CVE-2026-21718 (CVSS 10.0, broken cryptography), CVE-2026-24663 (CVSS 9.0, command injection) and CVE-2026-25085 (CVSS 8.6). CISA summarizes the combined impact as authentication bypass, denial of service, memory corruption and arbitrary code execution. Chaining an authentication-bypass sibling with this authenticated injection would raise practical risk, but that chain is not described in the cited sources.

Scoring differs by source: the CISA CNA vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (8.0 HIGH), while the NVD primary score is 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The exploit requires valid credentials and network reach to the XWEB Pro management interface. No public proof-of-concept and no in-the-wild exploitation are reported (CISA). The sources publish no network indicators, hashes or malware; defensible indicators are behavioral (shell metacharacters in the hostname field and anomalous child processes spawned by the management service).

Copeland has provided a fix. Users should update XWEB Pro to the latest version from the Copeland software update page, or, on an internet-connected device, via SYSTEM > Updates | Network. CISA recommends minimizing network exposure of control systems, placing them behind firewalls isolated from business networks, and using VPNs for remote access.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter

## Sources

- [CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10)
- [Claroty Team82 Disclosure Dashboard - CVE-2026-20764](https://it.claroty.com/team82/disclosure-dashboard/cve-2026-20764)
- [Copeland System Software Update (vendor fix)](https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate)
- [NVD - CVE-2026-20764](https://nvd.nist.gov/vuln/detail/CVE-2026-20764)
- [CVE Record CVE-2026-20764 (CISA ICS-CERT CNA)](https://cveawg.mitre.org/api/cve/CVE-2026-20764)
- [CISA CSAF - icsa-26-057-10](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json)
- [Claroty Team82 - CVE-2026-23702 (sibling, import preconfiguration)](https://blog.claroty.com/team82/disclosure-dashboard/cve-2026-23702)
- [Claroty Team82 - CVE-2026-24695 (sibling, OpenSSL utility route)](https://blog.claroty.com/team82/disclosure-dashboard/cve-2026-24695)
- [Critical Vulnerabilities Found in Copeland XWEB Pro Refrigeration Controllers](https://threatcluster.io/cluster/copeland-xweb-pro-vulnerabilities-let-attackers-gain-root-ac-886e8734)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3583