CVE Feed

    Dashboard / CVE / CVE-2026-21718

    CVE-2026-21718

    An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.

    Published:Feb 27, 2026
    Last Modified:Apr 17, 2026
    EPS:Feb 27, 2026
    EPSS Score:0.00054
    CVSS Score:10

    Affected Products

    Vendor
    Copeland
    Product
    Copeland Xweb 300d Pro
    Vendor
    Copeland
    Product
    Copeland Xweb 500b Pro
    Vendor
    Copeland
    Product
    Copeland Xweb 500d Pro
    Vendor
    Copeland
    Product
    Xweb 300d Pro
    Vendor
    Copeland
    Product
    Xweb 300d Pro Firmware
    Vendor
    Copeland
    Product
    Xweb 500b Pro
    Vendor
    Copeland
    Product
    Xweb 500b Pro Firmware
    Vendor
    Copeland
    Product
    Xweb 500d Pro
    Vendor
    Copeland
    Product
    Xweb 500d Pro Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-3037 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated …
    CVE-2026-20797 (CVSS 4.3) — A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthent…
    CVE-2026-22877 (CVSS 3.7) — An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated at…
    CVE-2026-25037 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticate…
    CVE-2026-25196 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-20764 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-25721 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-23702 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated…
    CVE-2026-24452 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticate…
    CVE-2026-25105 (CVSS 8) — An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenti…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High