Unauthenticated Remote Code Execution in Weaver E-cology 10.0
CVE-2026-22679

9.3CRITICAL

Key Information:

Vendor

Weaver Network Co., Ltd.

Status
E-cology
Vendor
CVE Published:
7 April 2026

Badges

📈 Score: 681👾 Exploit Exists🟡 Public PoC🟣 EPSS 21%📰 News Worthy

What is CVE-2026-22679?

CVE-2026-22679 is a high-severity vulnerability affecting Weaver E-cology version 10.0 prior to the release dated March 12, 2026. This software is commonly employed for enterprise resource planning and operational management. The vulnerability allows unauthenticated remote code execution through a specific debug endpoint (/papi/esearch/data/devops/dubboApi/debug/method). Attackers can exploit this flaw by crafting specially designed POST requests that manipulate the interfaceName and methodName parameters, enabling them to execute arbitrary commands on the system's backend. This poses severe risks as it bypasses any authentication requirements, allowing unauthorized actors to fully control affected instances and potentially compromise sensitive organizational data.

Potential impact of CVE-2026-22679

  1. Complete System Compromise: Attackers leveraging this vulnerability can execute arbitrary commands, which may lead to total takeover of the affected systems. This can result in significant operational disruptions and allow adversaries to manipulate or extract sensitive information.

  2. Data Breaches: The ability to remotely execute commands can facilitate unauthorized access to confidential data stored within the system. Organizations may face risks of data theft, loss, or exposure, leading to compliance violations and damage to their reputation.

  3. Propagation of Malware: Exploited systems can serve as entry points for further network compromise, allowing attackers to deploy ransomware or other malicious software. This not only affects the immediate system but can also facilitate lateral movement within the network, increasing the scope of the attack.

Affected Version(s)

E-cology 0 < 20260312

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-22679 - Proof of Concept

News Articles

favicon imageIt Security News

Critical Weaver E-cology RCE Vulnerability Actively Exploited in Attacks - IT Security News

A critical unauthenticated remote code execution vulnerability in the Weaver E-cology platform is currently being actively exploited in the wild. CVE-2026-22679 carries a maximum CVSS score of 9.8 and affects Weaver E-cology 10.0 builds released before 20260312. The security flaw…Read more →

favicon imageSwapupdate

Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API

Ravie LakshmananMay 05, 2026Vulnerability / Network Security

favicon imageThe Hacker News

Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API

CVE-2026-22679 exploited via debug endpoint in Weaver E-cology before 20260312, enabling RCE and system compromise.

References

https://www.weaver.com.cn/cs/securityDownload.html#
release-notes
https://h4cker.zip/post/d5d211/
technical-descriptionexploit
https://ti.qianxin.com/vulnerability/notice-detail/1760
third-party-advisory

EPSS Score

21% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 📰

    First article discovered by BleepingComputer

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Shadowserver Foundation
.