Field brief
CVE‑2026‑124014 remains a critical, unpatched XWEB EVO vulnerability
The XWEB EVO 4.3.0‑5.8.8 line still has an unauthenticated file‑write flaw, but no vendor advisory was issued during the 13‑14 Nov 2026 window.
The NVD lists CVE‑2026‑124014 as a critical 9.1‑score vulnerability affecting XWEB EVO 4.3.0 through 5.8.8; an unauthenticated POST to `config.lua` writes directly to `/etc/xwebconfig.json`, enabling configuration tampering and denial of service. The product line reached end‑of‑service in March 2026, and no vendor advisory or patch has been released since the NVD update on 13 Nov 2026. Defenders should verify whether any of their XWEB EVO installations remain in use and, if so, apply the latest available patch or upgrade to a supported product, monitor logs for unexpected `config.lua` POSTs and enforce strict access controls on the web interface. Link to the NVD record: CVE‑2026‑124014.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.