CVE-2026-23702
Published: 27 February 2026
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2026-23702 is an OS command injection vulnerability (CWE-78) in XWEB Pro version 1.12.1 and prior. The issue allows malicious input to be injected into the server username field during the import preconfiguration action in the API V1 route, published on 2026-02-27 with a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
An authenticated attacker with high privileges can exploit this vulnerability remotely by sending crafted input to the affected API endpoint, resulting in remote code execution on the underlying system.
CISA advisory ICSA-26-057-10, along with the associated CSAF document and Copeland's system software update page, provide guidance on mitigations, including available software updates to address the vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
OS command injection vulnerability in a network-accessible API endpoint enabling remote code execution directly maps to T1190: Exploit Public-Facing Application.