First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-24663

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Copeland	Copeland XWEB 300D PRO	<= 1.12.1
Copeland	Copeland XWEB 500D PRO	<= 1.12.1
Copeland	Copeland XWEB 500B PRO	<= 1.12.1

References

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-246645.3The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumerati CVE-2026-246655.4The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site CVE-2026-246666.5The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request CVE-2026-246675.0The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidat CVE-2026-246686.5The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access cont CVE-2026-246697.8The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an insecure password CVE-2026-24678.1Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags. This issue affects CVE-2026-246706.5The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access cont CVE-2026-246714.8The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site CVE-2026-246725.4The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site CVE-2026-246735.3The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a file upload valida CVE-2026-246746.1The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Reflected Cross-Si

CVE-2026-24663: Critical severity, CVSS 9.8 | Vulnix