CVE-2026-22877

9.1 criticalEPSS 0.6%

Critical (9.1) in copeland. EPSS 0.6% chance of exploitation in the next 30 days.

An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-02-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

copeland:xweb_300d_pro_firmware
copeland:xweb_500b_pro_firmware
copeland:xweb_500d_pro_firmware

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10

Check your stack JSON