CVE-2026-22679

Weaver (Fanwei) E-cology 10.0, a widely used Chinese enterprise OA/collaboration platform, contains a critical unauthenticated remote code execution vulnerability (CVSS 4.0: 9.3, CWE-306 missing authentication) in the /papi/esearch/data/devops/dubboApi/debug/method endpoint. An attacker triggers it by sending a crafted POST request with attacker-controlled interfaceName and methodName parameters, which invokes exposed debug functionality and reaches command-execution helpers without any credentials. Successful exploitation yields arbitrary command execution on the underlying system, enabling full server compromise. Organizations running E-cology 10.0 builds released before the 20260312 (March 12, 2026) update are affected. Exploitation has already been observed in the wild — the Shadowserver Foundation first detected scanning/exploitation on 2026-03-31 (UTC) — and EPSS puts the 30-day exploitation probability at 20.4% (97th percentile), though there is no public PoC and the flaw is not yet in CISA KEV.

What to do: Upgrade E-cology 10.0 to the 20260312 build or later immediately. Until patched, restrict internet exposure of /papi/ endpoints (especially /papi/esearch/data/devops/dubboApi/debug/method) via firewall/WAF rules, and review access logs for POST requests to that endpoint to check for exploitation since 2026-03-31.