PT-2026-22250 · Xweb Pro · Xweb Pro

Amir Zaltzman + 1 · Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-20902

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWEB Pro versions prior to 1.12.1

Description An operating system command injection issue exists that allows an authenticated attacker to execute code remotely. This is achieved by injecting malicious input into the map filename field during the map upload action of the parameters route.

Recommendations Update to a version of XWEB Pro later than 1.12.1.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-20902

Affected Products

Xweb Pro

References · 10

• https://osv.dev/vulnerability/CVE-2026-20902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20902 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json · Note
• https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-057-10 · Note
• https://twitter.com/cracbot/status/2029149945320902854 · Twitter Post
• https://twitter.com/CVEnew/status/2027380228834664718 · Twitter Post
• https://t.me/cveNotify/153393 · Telegram Post
• https://t.me/CVEtracker/45910 · Telegram Post
• https://twitter.com/cracbot/status/2028787739756515394 · Twitter Post