# Copeland vulnerabilities & exploitation > As of 2026-11-06, Threadlinqs tracks 11 Copeland CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 9 tracked threat campaigns. **Data as of:** 2026-11-06 ## Exploitation timeline Threadlinqs has recorded 11 Copeland CVEs published between 2026-02-15 and 2026-02-15. The busiest month was 2026-02 (11 new CVEs). None of them is listed in CISA KEV yet. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 11 of 11 tracked Copeland CVEs. - [CVE-2026-20764](https://intel.threadlinqs.com/cve/CVE-2026-20764) — HIGH 8 · EPSS 2.1% · 2026-02-27 - [CVE-2026-3037](https://intel.threadlinqs.com/cve/CVE-2026-3037) — HIGH 8 · EPSS 2.1% · 2026-02-27 - [CVE-2026-23702](https://intel.threadlinqs.com/cve/CVE-2026-23702) — HIGH 8 · EPSS 2.1% · 2026-02-27 - [CVE-2026-25037](https://intel.threadlinqs.com/cve/CVE-2026-25037) — HIGH 8 · EPSS 2.1% · 2026-02-27 - [CVE-2026-25196](https://intel.threadlinqs.com/cve/CVE-2026-25196) — HIGH 8 · EPSS 2.1% · 2026-02-27 - [CVE-2026-25721](https://intel.threadlinqs.com/cve/CVE-2026-25721) — HIGH 8 · EPSS 2.1% · 2026-02-27 - [CVE-2026-24695](https://intel.threadlinqs.com/cve/CVE-2026-24695) — HIGH 8 · EPSS 1.7% · 2026-02-27 - [CVE-2026-20797](https://intel.threadlinqs.com/cve/CVE-2026-20797) — MEDIUM 4.3 · EPSS 0.8% · 2026-02-27 - [CVE-2026-25085](https://intel.threadlinqs.com/cve/CVE-2026-25085) — HIGH 8.6 · EPSS 0.8% · 2026-02-27 - [CVE-2026-21718](https://intel.threadlinqs.com/cve/CVE-2026-21718) — CRITICAL 10 · EPSS 0.7% · 2026-02-27 - [CVE-2026-22877](https://intel.threadlinqs.com/cve/CVE-2026-22877) — LOW 3.7 · EPSS 0.6% · 2026-02-27 ## Products affected Threadlinqs normalises CPE and CNA product records across all 11 CVEs; 3 distinct Copeland products are affected. The most frequently affected: - XWEB 300D PRO — 11 CVEs - XWEB 500B PRO — 11 CVEs - XWEB 500D PRO — 11 CVEs ## Threat activity 9 tracked threat campaigns reference Copeland products or exploit Copeland CVEs: - [Second Wave of Attacks on European Supermarket Refrigeration Controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB) Forces Defrost Mode](https://intel.threadlinqs.com/threat/TL-2026-5186) — HIGH — 2026-11-03 - [Refrigeration controller attack in France: internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers forced into defrost cycles at hundreds of grocery stores (CVE-2025-41450)](https://intel.threadlinqs.com/threat/TL-2026-3667) — HIGH — 2026-10-15 - [CVE-2026-25721 - Copeland XWEB Pro OS Command Injection (Authenticated RCE) via API V1 Restore Action](https://intel.threadlinqs.com/threat/TL-2026-3587) — HIGH — 2026-10-15 - [CVE-2026-25196: Copeland XWEB Pro OS Command Injection via Wi-Fi SSID/Password Fields (Authenticated RCE)](https://intel.threadlinqs.com/threat/TL-2026-3586) — HIGH — 2026-10-15 - [CVE-2026-20764: OS Command Injection in Copeland XWEB Pro (hostname configuration) enables authenticated RCE](https://intel.threadlinqs.com/threat/TL-2026-3583) — HIGH — 2026-10-15 - [CVE-2026-25037: OS Command Injection in Copeland XWEB Pro (XWEB 300D/500D/500B PRO) Enabling Authenticated RCE](https://intel.threadlinqs.com/threat/TL-2026-3582) — HIGH — 2026-10-15 - [CVE-2026-22877: Copeland XWEB / XWEB Pro Unauthenticated Arbitrary File Read (Path Traversal)](https://intel.threadlinqs.com/threat/TL-2026-3579) — LOW — 2026-10-15 - [CVE-2026-20797: Copeland XWEB Pro Unauthenticated Stack-Based Buffer Overflow in API Route](https://intel.threadlinqs.com/threat/TL-2026-3578) — MEDIUM — 2026-10-15 - [CVE-2026-3037: OS Command Injection in Copeland XWEB Pro (MBird SMS service) enabling authenticated RCE](https://intel.threadlinqs.com/threat/TL-2026-3577) — HIGH — 2026-10-15 ## How to prioritise Copeland patching This order follows the data Threadlinqs holds for Copeland, not a generic severity checklist: - No Copeland CVE is in CISA KEV yet, so rank by exploit probability instead. - Outside KEV, the highest EPSS scores are [CVE-2026-20764](https://intel.threadlinqs.com/cve/CVE-2026-20764) (2.1%), [CVE-2026-3037](https://intel.threadlinqs.com/cve/CVE-2026-3037) (2.1%), [CVE-2026-23702](https://intel.threadlinqs.com/cve/CVE-2026-23702) (2.1%). - 1 CVE scores Critical and 8 High on CVSS v3 (maximum 10, average 7.5); sequence these after KEV and high-EPSS items. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-06 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/copeland All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs for threats exploiting Copeland products unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp