PT-2026-22279 · Xweb Pro · Xweb Pro

Amir Zaltzman + 1 · Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-3037

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWEB Pro versions 1.12.1 and earlier

Description A flaw exists that allows a logged-in attacker to execute code on a system remotely. This is achieved by altering harmful input within the URL of the MBird SMS service and/or code through the utility path. This input is then processed during system configuration, resulting in remote code execution. The vulnerability is an OS command injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-3037

Affected Products

Xweb Pro

References · 10

• https://osv.dev/vulnerability/CVE-2026-3037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3037 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json · Note
• https://twitter.com/CVEnew/status/2027380215152890332 · Twitter Post
• https://twitter.com/cracbot/status/2029149985565229572 · Twitter Post
• https://t.me/CVEtracker/45921 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2027310886872842557 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-26-057-10 · Note
• https://twitter.com/cracbot/status/2028787783582830885 · Twitter Post
• https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate · Note