Arbitrary File-Read Vulnerability in XWEB Pro by Copeland
CVE-2026-22877

3.7LOW

Key Information:

Vendor

Copeland

Status
Copeland Xweb 300d Pro
Copeland Xweb 500d Pro
Copeland Xweb 500b Pro
Vendor
CVE Published:
27 February 2026

What is CVE-2026-22877?

An arbitrary file-read vulnerability exists in XWEB Pro versions 1.12.1 and earlier. This flaw allows unauthenticated attackers to access sensitive files on the system, which could lead to unauthorized information disclosure and potentially expose the server to further attacks, including denial-of-service scenarios.

Affected Version(s)

Copeland XWEB 300D PRO 0 <= 1.12.1

Copeland XWEB 500B PRO 0 <= 1.12.1

Copeland XWEB 500D PRO 0 <= 1.12.1

References

https://webapps.copeland.com/Dixell/Pages/SystemSoftwareU...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA.
.