Weaver E-cology RCE Flaw CVE-2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-22679 | Unauthenticated RCE in Weaver E-cology 10.0 Weaver (Fanwei) E-cology 10.0, a widely used Chinese enterprise OA/collaboration platform, contains a critical unauthenticated remote code execution vulnerability (CVSS 4.0: 9.3, CWE-306 missing authentication) in the /papi/esearch/data/devops/dubboApi/debug/method endpoint. An attacker triggers it by sending a crafted POST request with attacker-controlled interfaceName and methodName parameters, which invokes exposed debug functionality and reaches command-execution helpers without any credentials. Successful exploitation yields arbitrary command execution on the underlying system, enabling full server compromise. Organizations running E-cology 10.0 builds released before the 20260312 (March 12, 2026) update are affected. Exploitation has already been observed in the wild — the Shadowserver Foundation first detected scanning/exploitation on 2026-03-31 (UTC) — and EPSS puts the 30-day exploitation probability at 20.4% (97th percentile), though there is no public PoC and the flaw is not yet in CISA KEV. Do: Upgrade E-cology 10.0 to the 20260312 build or later immediately. Until patched, restrict internet exposure of /papi/ endpoints (especially /papi/esearch/data/devops/dubboApi/debug/method) via firewall/WAF rules, and review access logs for POST requests to that endpoint to check for exploitation since 2026-03-31. | 9.3 | 20% |
| largetens of thousands of deployments plausibly affected (order of magnitude 10k–100k); exact count unknown |
Full article368 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 05, 2026Vulnerability / Network Security
A critical security vulnerability in Weaver (Fanwei) E-cology, an enterprise office automation (OA) and collaboration platform, has come under active exploitation in the wild.
The vulnerability (CVE-2026-22679, CVSS score: 9.8) relates to a case of unauthenticated remote code execution affecting Weaver E-cology 10.0 versions prior to 20260312. The issue resides in the "/papi/esearch/data/devops/dubboApi/debug/method" endpoint that allows an attacker to execute arbitrary commands by invoking exposed debug functionality.
"Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system," according to a description of the flaw in the NIST National Vulnerability Database (NVD).
The advisory also noted that the Shadowserver Foundation observed the first signs of active exploitation on March 31, 2026. A similar alert published by QiAnXin on March 17, 2026, revealed that the Chinese security vendor was able to successfully reproduce the remote code execution vulnerability without sharing any further details.
However, in a report published last week, the Vega Research Team said it identified active exploitation of CVE-2026-22679 much before, with the earliest evidence of abuse dating back to March 17, 2026, five days after patches were shipped for the flaw.
"The intrusion unfolded over roughly a week of operator activity: RCE verification, three failed payload drops, an attempted pivot to an MSI implant that did not produce a working install, and a short burst of attempts to retrieve PowerShell payloads from attacker-controlled infrastructure," security researcher Daniel Messing said.
The MSI installer, per the Israeli cybersecurity company, used the name "fanwei0324.msi," indicating an attempt to pass off the malicious payload as harmless by using the romanized Chinese name for Weaver. The unknown threat actor has also been observed running discovery commands, such as whoami, ipconfig, and tasklist, throughout the campaign.
Security researcher Kerem Oruc has made available a Python-based detection script that identifies vulnerable Weaver E-cology instances by checking if the susceptible API endpoint is accessible. Users are advised to apply the updates, if not already, to stay protected.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/05/weaver-e-cology-rce-flaw-cve-2026-22679.html