CVE-2026-21389
Published: 27 February 2026
Description
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by enforcing input validation and sanitization mechanisms at entry points like the contacts import route request body.
Mitigates the specific vulnerability through timely flaw remediation, such as applying vendor-provided software updates for XWEB Pro.
Complements input validation by restricting the types and characteristics of information accepted into the system, reducing opportunities for malicious command injection.
Security SummaryAI
CVE-2026-21389 is an OS command injection vulnerability (CWE-78) in XWEB Pro version 1.12.1 and prior. Published on 2026-02-27, it affects the contacts import route, where an attacker can inject malicious input into the request body to achieve remote code execution on the system. The vulnerability carries a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
An authenticated attacker with high privileges (PR:H) can exploit this vulnerability remotely over the network (AV:N). Exploitation requires high attack complexity (AC:H) but no user interaction (UI:N), enabling a change in scope (S:C) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). Successful attacks result in full remote code execution on the affected system.
CISA's ICS Advisory ICSA-26-057-10 addresses this vulnerability, with details available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10 and in CSAF JSON format at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json. Copeland provides system software updates for mitigation at https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection vulnerability in a remotely accessible web application (contacts import route) directly enables exploitation of public-facing applications (T1190) and facilitates arbitrary OS command execution (T1059).