CVE-2026-25085 is a high severity authentication bypass (CVSS 8.6) in Copeland XWEB Pro version 1.12.1 and earlier. An unexpected return value from the authentication routine is later treated as valid. Copeland has a fix and recommends updating XWEB Pro to the latest version through its software update page.
What's affected
- Affected: Copeland XWEB Pro version 1.12.1 and prior, on the XWEB 300D Pro, 500B Pro and 500D Pro and their firmware.
- Fixed in: the latest version from Copeland. The CISA advisory does not name a version number here, so check the vendor page.
CISA published the advisory as ICSA-26-057-10. It covers several vulnerabilities in the same product, so read the whole advisory, not only this CVE.
How to check if you're exposed
Log in to the XWEB Pro and read the software version from the system information. Anything at or below 1.12.1 is affected. Then ask whether the device is reachable from anywhere other than a trusted management network. CISA's general guidance for control systems is to keep them off the internet and behind firewalls, and to use secure remote access such as a VPN when remote access is needed.
What to do now
- Download the update from Copeland's software update page for your XWEB Pro model.
- Or, for a device with internet access, update from the device menu: System, then Updates, then Network. The advisory describes this route.
- Remove the device from direct internet exposure.
- Put it behind a firewall and use a VPN for remote access.
- Review the other vulnerabilities in the same CISA advisory, because the same update addresses them.
Why it matters
The weakness is CWE-394 (Unexpected Status Code or Return Value). The authentication code returned a value it did not expect, and the caller accepted it as success. This is a failure to handle an error path. Code that checks only for the good case can fall into the open state when something else comes back.
For building controls and refrigeration monitoring, the device is part of a physical process. Bypassing a login on a monitor can change set points or hide alarms. Patch it as you would an application server.
Quick check
Is CVE-2026-25085 exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability. The CISA advisory page I read does not say it has been exploited.
What version fixes it?
The advisory points to the latest version on Copeland's update page without naming one. Check that page for your model.
Sources
Last reviewed: 19 October 2026.
