CVE-2026-21718 is an authentication bypass in Copeland XWEB Pro 1.12.1 and earlier, scored 10.0 (Critical). Attackers can skip the login and reach code execution on the device before authenticating. Copeland has released a fix, so update the unit from the Copeland software update page or the device update menu.
What's affected
- Products: Copeland XWEB 300D Pro, XWEB 500D Pro and XWEB 500B Pro, with their firmware
- Affected: version 1.12.1 and prior
- Fixed: Copeland says it has provided a fix and recommends the latest version. The advisory names no version number
- Advisory: CISA ICSA-26-057-10, released February 26, 2026. It lists many CVEs for the same products, including authentication bypass, denial of service, memory corruption and code execution
- Sector noted by CISA: Commercial Facilities
- Status: The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
This guide covers only CVE-2026-21718. The advisory lists other CVEs for the same units, so an update that closes this one should be treated as the start of a review.
How to check if you're exposed
Read the firmware version from the XWEB Pro unit and compare it with 1.12.1. Anything at that version or lower is affected.
Then check how the unit is reached. These devices are controllers that often sit on a network for remote monitoring. Review whether the web interface is exposed to the internet or to wider internal networks than it should be, and review remote access settings.
What to do now
- Update each XWEB Pro unit to the latest version from the Copeland software update page for your model.
- If the unit has internet access, you can update it from the menu named System, Updates, Network, as the advisory describes.
- Remove internet exposure and use a VPN for remote access.
- Segment the unit from business networks, and allow only the hosts that need to reach it.
- Review the other CVEs in the CISA advisory and confirm that the update covers them.
Why it matters
The record gives CWE-327, use of a broken or risky cryptographic algorithm, as the weakness behind this bypass, and the description says any attacker can skip the authentication requirement and run code before logging in. CISA lists a separate authentication bypass for the same product family, so the unit has more than one problem in this area.
The 10.0 score reflects network reach, no required login and a scope change, which means a compromise can spread past the device. Controllers like this one sit on networks and manage equipment, so they deserve the same patch discipline as servers.
Update promptly, and then confirm that the web interface is reachable only by the people who need it.
Quick check
Is there a version number for the fix?
The CISA advisory says Copeland has provided a fix and recommends the latest version, without naming a number. Use the Copeland update page for your model.
Does this advisory cover other bugs?
Yes. CISA lists many CVEs for the same products in ICSA-26-057-10, so review the whole advisory.
Sources
Last reviewed: 19 October 2026.
