CVE-2026-22679: Weaver (Fanwei) E-cology unauthenticated RCE via exposed debug endpoint, exploited in the wild
The short version: Weaver (Fanwei) E-cology — a widely deployed collaboration/OA platform — exposes a debug endpoint with no authentication (CVE-2026-22679) that lets an unauthenticated attacker execute arbitrary OS commands. It scores 9.8, and exploitation has been observed in the wild. It is not (as of this writing) in CISA's KEV catalog, but active use makes it urgent where the product is exposed. Patch to the fixed build. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE, confirmed exploited, though not KEV-listed |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 21.48% · 97.34th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Yes — in-the-wild exploitation first observed by the Shadowserver Foundation on 2026-03-31 |
| Vulnerability type | CWE-306 missing authentication for critical function → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Weaver (Fanwei) E-cology 10.0, versions prior to 20260312 |
| Fixed in | Build 20260312 (see Weaver security download page) |
What you need to know
CVE-2026-22679 is a missing-authentication flaw: the /papi/esearch/data/devops/dubboApi/debug/method endpoint exposes debug functionality without requiring any authentication. An attacker sends a crafted POST with attacker-controlled interfaceName and methodName parameters, reaches command-execution helpers behind that debug interface, and achieves arbitrary command execution on the server — no login, no chain.
Why this is worth prioritizing where you run it:
- It's pre-authentication. The dangerous endpoint should never have been reachable unauthenticated; that's the entire bug.
- It's a core business platform. E-cology handles collaboration, workflow, and documents, so code execution there reaches sensitive data and the network around it.
- It's already being exploited. In-the-wild activity was observed shortly after disclosure — the theoretical is operational, even though CISA hasn't added it to KEV.
How serious we see it
High — serious mechanics and confirmed exploitation, held just short of Critical on exposure.
Unauthenticated RCE with active exploitation is close to the top of anyone's queue. We rate it High rather than Critical primarily because it is not KEV-listed and the affected platform's internet-facing footprint is concentrated in specific markets — so the population of exposed, at-risk systems is narrower than a universal appliance flaw. For any organization that does run E-cology reachable from the internet, treat it as urgent. The reassuring part: it affects a specific version line, a fixed build exists, and confirming exposure is quick.
Recommendations
Straight from the vendor's guidance:
- Patch now. Upgrade Weaver E-cology to build 20260312 or later.
- Assume nothing given the exploitation — hunt. Review logs for requests to the
/papi/esearch/.../dubboApi/debug/methodendpoint and any unexpected process execution before your patch date. - If you find indicators, respond. Isolate the server, rotate credentials and secrets, and investigate for lateral movement.
- Harden exposure. Keep E-cology off the public internet where possible; restrict access to trusted networks or a VPN and block the debug endpoint at the proxy.
- Confirm your exposure first. Verify whether any E-cology instance is reachable from the internet, and which build.
How BreachRisk sees it
BreachRisk discovers internet-facing E-cology instances from little more than your domain, fingerprints the product and version, and flags exposure tied to this actively-exploited vulnerability so it rises to the top of your results. Looking from the outside in is how a niche-but-critical platform exposure gets caught early — surfaced as a ranked finding rather than waiting for it to appear in a catalog after the fact.