Home / Vulnerability Intelligence / CVE-2026-24663

CVE-2026-24663 - Vulnerability Analysis

CriticalCVSS: 9.0

Last Updated: February 27, 2026

XWEB Pro - Remote Code Execution

Published: February 27, 2026Updated: February 27, 2026Remote Exploitable

Overview

XWEB Pro <= 1.12.1 contains an OS command injection caused by improper input sanitization in the libraries installation route, letting unauthenticated attackers achieve remote code execution by sending crafted requests.

Severity & Score

Severity: Critical

CVSS Score: 9.0

EPSS Score: 135.5%(Probability of exploitation in next 30 days)

Impact

Unauthenticated attackers can execute arbitrary commands remotely, potentially taking full control of the system.

Mitigation

Update to the latest version of XWEB Pro.

References

Social Media Activity(1 post)

ZEN SecDB

@secdb

Mar 2, 2026

📈 CVE Published in last 7 days (2026-02-23 - 2026-03-02) See more at https://secdb.nttzen.cloud/dashboard Total CVEs: 974 Severity: - Critical: 145 - High: 315 - Medium: 431 - Low: 49 - None: 34 Status: - : 10 - Analyzed: 435 - Awaiting Analysis: 257 - Modified: 60 - Received: 119 - Rejected: 17 - Undergoing Analysis: 76 Top CNAs: - GitHub, Inc.: 354 - VulDB: 131 - VulnCheck: 70 - Mozilla Corporation: 52 - ICS-CERT: 51 - MITRE: 34 - Wordfence: 34 - Red Hat, Inc.: 15 - Cisco Systems, Inc.: 15 - GitLab Inc.: 13 Top Affected Products: - UNKNOWN: 459 - Mozilla Firefox: 52 - Mozilla Thunderbird: 50 - Imagemagick: 34 - Open-emr Openemr: 25 - Copeland Xweb 300d Pro Firmware: 15 - Freerdp: 15 - Copeland Xweb 500b Pro Firmware: 15 - Copeland Xweb 500d Pro Firmware: 15 - Tenda F453 Firmware: 10 Top EPSS Score: - CVE-2026-3301 - 2.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3301) - CVE-2025-70328 - 2.51 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70328) - CVE-2026-20127 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127) - CVE-2025-70327 - 1.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70327) - CVE-2026-24663 - 1.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24663) - CVE-2026-22553 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22553) - CVE-2026-26222 - 0.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26222) - CVE-2026-26331 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26331) - CVE-2026-27498 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27498) - CVE-2026-21658 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21658)

View original post

Related Resources

Details

CVE ID: CVE-2026-24663
Severity: Critical
CVSS Score: 9.0
Type: command_injection
Status: unconfirmed
EPSS: 135.5%
Social Posts: 1

CWE

CWE-78

CVSS Metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score

135.5%Probability of exploitation in the next 30 days