VulnSocial

CVE-2026-21389Disclosure(copeland / xweb_300d_pro)

MEDIUMCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch copeland xweb_300d_pro systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route.

copeland CVEsBack to dashboard
4.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-78

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • xweb_300d_pro
  • xweb_300d_pro_firmware
  • xweb_500b_pro
  • xweb_500b_pro_firmware

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 3d ago at 1 mentions (2026-02-11); latest day: 1
  • 4 total mentions across 4 days

Affected systems

Vendors
copeland
Products
xweb_300d_proxweb_300d_pro_firmwarexweb_500b_proxweb_500b_pro_firmwarexweb_500d_proxweb_500d_pro_firmware

1 version affected across 6 products

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-02-11: 1Mentions · 2026-02-27: 1Mentions · 2026-03-03: 1Mentions · 2026-03-04: 1Active Exploitation · 2026-02-11: 1Patch / Workaround · 2026-02-11: 1Technical Details · 2026-02-11: 1Technical Details · 2026-02-27: 1Technical Details · 2026-03-03: 1Technical Details · 2026-03-04: 102-1102-2703-0303-04
Signal classification2 categories
Disclosure
375.0%
Active Exploitation
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-02-111
Active Exploitation1
2026-02-271
Disclosure1
2026-03-031
Disclosure1
2026-03-041
Disclosure1
Full discourse4 posts
  • CRAC Learning - Tech@cracbot
    Disclosure

    CVE-2026-21389 (CVSS:8.0, HIGH) is Analyzed. An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker ..https://nvd.nist.gov/vuln/detail/CVE-2026-21389 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    Post summary

    The post announces CVE-2026-21389, an OS command injection vulnerability in XWEB Pro 1.12.1 and earlier, with a CVSS score of 8.0 (HIGH).

    0000019
    173 followersView on X
  • CRAC Learning - Tech@cracbot
    Disclosure

    CVE-2026-21389 (CVSS:8.0, HIGH) is Analyzed. An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker ..https://nvd.nist.gov/vuln/detail/CVE-2026-21389 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    Post summary

    The post announces CVE-2026-21389, an OS command injection vulnerability in XWEB Pro 1.12.1 and earlier, with a CVSS score of 8.0, but does not mention PoC, exploit, patch, or active exploitation.

    0000041
    173 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-21389 An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system… https://www.cve.org/CVERecord?id=CVE-2026-21389

    Post summary

    The post announces the existence of CVE‑2026‑21389, an OS command injection flaw in XWEB Pro that allows authenticated attackers to achieve remote code execution.

    00000142
    56.6K followersView on X
  • ThreatSynop@ThreatSynop
    Active Exploitation

    🚨 MSHTML Zero-Day CVE-2026-21389 Exploited via Malicious Web/HTML Content Microsoft patched CVE-2026-21389, an actively exploited MSHTML (Trident) memory-corruption flaw that can be triggered by crafted web/HTML content to achieve code execution in the context of the current user. Prioritize patching on systems where legacy IE components are still reachable (Office/embedded web controls), and monitor for suspicious .hta/.html delivery chains. 🎯 Target: Global/Windows (Enterprise endpoints) #️⃣ Category: #Vulnerability #BlueTeam #TargetedAttacks 🔗 URL: https://cybersecuritynews.com/mshtml-framework-0-day-vulnerability/

    Post summary

    Microsoft has patched CVE‑2026‑21389, a memory‑corruption flaw in MSHTML that is actively exploited via crafted web/HTML content. Systems with legacy IE components should prioritize patching and monitor for suspicious delivery chains.

    0000046
    191 followersView on X
CPE platform detail6 entries

6 of 6 entries

PartVendorProductVersionTarget SWTarget HW
HWcopelandxweb_300d_pro---
OScopelandxweb_300d_pro_firmware---
HWcopelandxweb_500b_pro---
OScopelandxweb_500b_pro_firmware---
HWcopelandxweb_500d_pro---
OScopelandxweb_500d_pro_firmware---

Explore more

Back to dashboardcopeland CVEsxweb_300d_pro vulnerabilities