CVE-2026-124004 is a critical hardcoded-credential flaw in Copeland XWEB EVO before 5.6.2 that lets unauthenticated remote attackers take full administrative control of the application.
What Is It
XWEB EVO versions before 5.6.2 contain a hardcoded backdoor password for the built-in Administrator account. NVD classifies the weakness as CWE-798 (Use of Hard-coded Credentials). VulnCheck reported the flaw, and NVD published it on November 12, 2026.
According to the NVD description, an attacker can authenticate with the hardcoded credential in a single request. That request returns a complete admin session and full control over the application. The attacker needs no prior access and no user interaction.
Why It Matters
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL (VulnCheck, secondary)
The attack works over the network with low complexity, no privileges and no user interaction. It has a high impact on confidentiality, integrity and availability. The attacker also gets the built-in Administrator account, which is the highest level of access in the application.
The CVE is tagged unsupported-when-assigned. The NVD description says the XWEB EVO product line reached its end-of-service date in March 2026, so this product was already past end of service when the CVE was assigned.
Exploitation status: CVE-2026-124004 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. As of publication on November 12, 2026, neither the NVD record nor the VulnCheck advisory reports in-the-wild exploitation. That does not rule out exploitation that has not been publicly reported.
What's Vulnerable
| Vendor | Product | Affected | Unaffected |
|---|---|---|---|
| Copeland | XWEB EVO | All versions < 5.6.2 | 5.6.2 |
NVD's status for this CVE is "Deferred," and the record lists no CPE configurations.
Patch Status
The affected-version data marks XWEB EVO 5.6.2 as unaffected. Organizations running earlier versions should upgrade to 5.6.2 or later through Copeland's system software update page (linked below).
Because the product line reached end of service in March 2026, check Copeland's end-of-service bulletin for what support remains. Plan for replacement over the long term. CISA has issued no required action, because the CVE is not in KEV.