CVE Intelligence
Analysis AI-assisted

CVE-2026-22877: Copeland XWEB and XWEB Pro Path Traversal

CVE-2026-22877 affects Copeland XWEB Pro devices at version 1.12.1 and earlier, as stated in the record, and is described as an arbitrary file-read flaw that can be reached without authentication. The record classifies the weakness as path traversal (CWE-22) and shows a critical severity with a CVSS score of 9.1 from NVD, while the CISA ICS-CERT entry scores it 3.7. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an arbitrary file-read flaw in Copeland XWEB and XWEB Pro devices at version 1.12.1 and earlier, reachable by unauthenticated attackers. The record classifies it as path traversal (CWE-22). The CISA advisory is available at ICSA-26-057-10.

Impact

  • Confidentiality: the NVD vector rates the confidentiality impact as high.
  • Availability: the NVD vector rates the availability impact as high, and the description notes a possible denial-of-service effect.
  • Integrity: the NVD vector rates the integrity impact as none.

Affected products and versions

  • Copeland XWEB 300D PRO, XWEB 500B PRO and XWEB 500D PRO, including the matching firmware entries listed in the record.
  • Versions 1.12.1 and earlier, according to the record.

Exploitation status

The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The SSVC and EPSS values in the record are low and do not indicate automatable exploitation.

Remediation and mitigation

  • The record lists no fixed version. Check the vendor page Copeland Dixell system software update and apply any update the vendor issues.
  • Restrict network access to device management interfaces and keep them off untrusted networks.
  • Segment operational technology and building-automation networks so controllers are not reachable from general IT or the internet.
  • Follow the guidance in the CISA advisory.

Detection guidance

  • Review web interface access logs for requests referencing files or paths outside the expected application scope.
  • Monitor for unexpected restarts or loss of availability on these devices.
  • Alert on management access from unexpected source addresses.

Limitations of the available information

  • The record gives no fixed version and no patch details.
  • NVD scores the issue 9.1, while the CISA ICS-CERT entry scores it 3.7. The record does not explain the difference.
  • The record does not describe specific file paths or exploitation mechanics, and this analysis does not cover them.
  • The EPSS values are as recorded and may change over time.

Frequently asked questions

What is CVE-2026-22877?

It is an arbitrary file-read flaw in Copeland XWEB and XWEB Pro devices at version 1.12.1 and earlier, classified in the record as path traversal (CWE-22).

Is this vulnerability known to be exploited?

The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Is there a fixed version?

The record lists no fixed version. Check the vendor page and apply any update the vendor issues.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.