Threat reportVulnerabilityTL-2026-3587
CVE-2026-25721 - Copeland XWEB Pro OS Command Injection (Authenticated RCE) via API V1 Restore Action
CVE-2026-25721 (TL-2026-3587), also tracked as ICSA-26-057-10, is a high-severity software vulnerability scored CVSS 8, first published 2026-10-15. It has no confirmed attribution, affects Copeland XWEB 300D PRO, references 1 CVE (CVE-2026-25721), maps to 5 MITRE ATT&CK techniques (T0807, T0859, T1059), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3587
- Threat ID
- TL-2026-3587
- Also known as
- ICSA-26-057-10, EUVD-2026-8979
- Severity
- HIGH
- CVSS
- 8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- commercial facilities
- Target regions
- Worldwide
- Detection rules
- 9
- Indicators of compromise
- 9
How CVE-2026-25721 works
An OS command injection flaw (CWE-78) in Copeland XWEB Pro 1.12.1 and prior lets an authenticated attacker execute arbitrary code by injecting input into the server username and/or password fields of the restore action in the API V1 route. It affects XWEB 300D PRO, 500D PRO and 500B PRO; CISA reported no known public exploitation at publication.
CVE-2026-25721 is an OS command injection vulnerability (CWE-78) in the web management interface of Copeland XWEB Pro, a commercial-facilities monitoring and control platform. In XWEB 300D PRO, XWEB 500D PRO and XWEB 500B PRO firmware at version 1.12.1 and earlier, the restore action of the API V1 route passes the server username and/or password fields into an OS command without neutralizing special elements. An authenticated attacker who submits crafted values in those fields can run arbitrary commands on the underlying system, resulting in remote code execution.
The CNA (CISA ICS) scored the issue CVSS v3.1 8.0 HIGH (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting the need for high privileges and non-trivial conditions. NVD's primary analysis scored it 8.8 HIGH (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires network reachability of the XWEB management interface and valid credentials, so exposure of the interface and credential hygiene determine real-world risk.
The flaw is one of 23 vulnerabilities in XWEB Pro reported by Amir Zaltzman and Noam Moshe of Claroty Team82 and covered by CISA advisory ICSA-26-057-10. The set includes a CVSS 10.0 pre-authenticated code execution via authentication bypass (CVE-2026-21718, CWE-327), an unauthenticated command injection in library installation (CVE-2026-24663) and an authentication bypass (CVE-2026-25085), plus many authenticated command injections. A separate restore-route injection, CVE-2026-25111, is also in the set. Because pre-authentication flaws exist in the same product, an authenticated-only injection such as this one may be chained with them. That chaining is an analytic inference and is not stated in the sources.
The sources give no public PoC, in-the-wild exploitation, threat actor, malware, C2 infrastructure or network IOCs for this CVE. CISA states that no known public exploitation specifically targeting these vulnerabilities has been reported. The vendor remediation is to update to the latest XWEB Pro software through the Copeland software update page, or through SYSTEM > Updates | Network on internet-connected devices. The sources give no specific fixed version number. CISA also advises minimizing control-system internet exposure, placing networks behind firewalls and using VPNs for remote access.
MITRE ATT&CK techniques used in TL-2026-3587
Execution
T0807 Command-Line Interface; T1059 Command and Scripting Interpreter
persistence
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Affected products and versions in CVE-2026-25721
- Copeland — XWEB 300D PRO
Vulnerable versions: <=1.12.1
Fixed in: Latest XWEB Pro release (version not specified) - Copeland — XWEB 500D PRO
Vulnerable versions: <=1.12.1
Fixed in: Latest XWEB Pro release (version not specified) - Copeland — XWEB 500B PRO
Vulnerable versions: <=1.12.1
Fixed in: Latest XWEB Pro release (version not specified)
Remediation for CVE-2026-25721
Patches
- Latest XWEB Pro software from https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate (no specific fixed version number is stated in the sources)
Immediate actions
- Update XWEB 300D PRO, 500D PRO and 500B PRO to the latest XWEB Pro software release (greater than 1.12.1) via the Copeland software update page
- On internet-connected devices use the SYSTEM > Updates | Network menu to apply the update
- Restrict network access to the XWEB management interface and API V1 route to trusted management hosts only
Workarounds
- No vendor workaround is documented; limit XWEB account privileges and rotate credentials of accounts able to reach the restore function
Longer-term hardening
- Minimize internet exposure of control system devices
- Place control system networks and remote devices behind firewalls, isolated from business networks
- Use VPNs for remote access, and keep the VPN updated
- Perform impact analysis and risk assessment before deploying defensive measures
CVEs associated with CVE-2026-25721
Weaknesses (CWE) in CVE-2026-25721
Timeline of CVE-2026-25721
- CVE-2026-25721 reserved in the CVE program (CNA: CISA ICS).
- Copeland remediation published: update to the latest XWEB Pro software via the Copeland software update page or SYSTEM > Updates | Network; no specific fixed version number is stated.
- The same advisory disclosed 22 sibling XWEB Pro flaws, including CVE-2026-21718 (CVSS 10.0, CWE-327), CVE-2026-24663 (CVSS 9.0 unauthenticated command injection), CVE-2026-25085 (CVSS 8.6) and the restore-route injection CVE-2026-25111.
- CISA released the machine-readable CSAF document icsa-26-057-10.json for the advisory, listing XWEB 300D PRO, 500D PRO and 500B PRO at version 1.12.1 and prior as affected.
- CISA published ICS advisory ICSA-26-057-10 covering 23 Copeland XWEB/XWEB Pro vulnerabilities including CVE-2026-25721; no known public exploitation reported.
- CVE-2026-25721 published (CVSS v3.1 8.0 HIGH, CWE-78) and added to NVD; credited to Amir Zaltzman and Noam Moshe of Claroty Team82.
- CVE.org record for CVE-2026-25721 updated.
- NVD last modified the CVE-2026-25721 entry, which now carries a primary NVD score of 8.8 HIGH alongside the CNA score of 8.0.
Sources cited for CVE-2026-25721
- CISA ICS Advisory ICSA-26-057-10 - Copeland XWEB and XWEB Pro
- Claroty Team82 Disclosure Dashboard - CVE-2026-25721
- Copeland XWEB System Software Update
- NVD - CVE-2026-25721
- CVE.org CVE Record - CVE-2026-25721
- CISA CSAF - icsa-26-057-10.json
- EUVD-2026-8979 - CVE-2026-25721
- Lutra Security Field Guide - CVE-2026-25721
Detection coverage for TL-2026-3587
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3587 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.