PT-2026-22271 · Xweb Pro · Xweb Pro

Amir Zaltzman + 1 · Published 2026-02-27 · Updated 2026-05-10 · CVE-2026-20797

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWEB Pro versions prior to 1.12.1

Description A stack-based buffer overflow exists in an API route of XWEB Pro. This allows unauthenticated attackers to cause stack corruption and program termination. The vulnerable API route is not specified.

Recommendations Update XWEB Pro to version 1.12.1 or later.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2026-20797

Affected Products

Xweb Pro

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-20797 · Security Note
• https://osv.dev/vulnerability/CVE-2026-20797 · Vendor Advisory
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json · Note
• https://twitter.com/CVEnew/status/2027380216381710386 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027339041327190277 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-26-057-10 · Note
• https://t.me/cveNotify/153399 · Telegram Post
• https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate · Note
• https://t.me/cveNotify/162941 · Telegram Post