Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API
Summary: A critical unauthenticated remote code execution flaw in Weaver (Fanwei) E-cology, tracked as CVE-2026-22679 with a CVSS score of 9.8, affects version 10.0 prior to 20260312 through the "/papi/esearch/data/devops/dubboApi/debug/method" endpoint, where attacker-controlled interfaceName and methodName parameters in POST requests reach command-execution helpers. The Shadowserver Foundation saw first signs of active exploitation on March 31, 2026, while the Vega Research Team traced earliest abuse to March 17, 2026, five days after patches shipped, in an intrusion that included RCE verification, three failed payload drops, an attempted pivot to an MSI implant named "fanwei0324.msi" that did not produce a working install, and discovery commands such as whoami, ipconfig, and tasklist.
What you should know: Exploitation began five days after the patch was available, and the attacker's MSI payload was disguised under the romanized Chinese name for Weaver - an unknown threat actor was already inside before most defenders had a chance to act on the advisory.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-22679
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026