CVE-2026-22679

VendorweaverProducte-cologyDiscoveredApr 7, 2026UpdatedOct 26, 2026

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).

View graph Watch Export

CVSS v3.1

9.8 CRITICAL

EPSS

20.4%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Sep 4, 2026

▼ 1.12pp

21.5% → 20.4% over 2 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Connections

4 relationships

CWE-306

source

Timeline

disclosure → media coverage

Apr 7, 2026

Disclosure — published as a CVE record. · last revised by NVD Oct 26, 2026

May 4, 2026

bleepingcomputer.com reports: Weaver E-cology critical bug exploited in attacks since March

May 5, 2026

thehackernews.com reports: Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API

Public PoC (1)

github.com/keraattin/CVE-2026-22679

Unverified third-party code — review before executing.