Critical severity · published Apr 7, 2026
CVE-2026-22679
Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint
9.8
CVSS
20.4%
EPSS
No
On KEV
Description
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)20.4% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
E-cology · Weaver Network Co., Ltd.
before 20260312 · source: vendor, NVD
In the news
ThreatIntelCritical
Weaver E-cology critical bug exploited in attacks since March
Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mid-March to run discovery commands. [...]
May 4, 2026·BleepingComputer
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22679
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22679
Broken Link
https://h4cker.zip/post/d5d211/
Third Party Advisory
https://ti.qianxin.com/vulnerability/notice-detail/1760
Third Party Advisory
https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-rce-via-dubboapi-debug-endpoint
Patch
https://www.weaver.com.cn/cs/securityDownload.html#
blog.vega.io
https://blog.vega.io/posts/cve-2026-22679-weaver-ecology-exploitation/
More from E-cology
8.2
CVE-2025-71434
Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
7.5
CVE-2021-48013
Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload
7.5
CVE-2019-25776
Weaver E-cology SQL Injection via SyncUserInfo.jsp
7.5
CVE-2022-50992
Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet