CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint
Unauthenticated attackers can execute arbitrary commands via exposed debug endpoints in Weaver E-cology, requiring immediate patching.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22679?
CVE-2026-22679 is a critical code injection vulnerability in Weaver Network Co., Ltd. E-cology, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).
Weakness: CWE-306
Which versions are affected by CVE-2026-22679?
It affects 1 product.
Products include Weaver E-Cology.
How do I fix CVE-2026-22679?
No fix has been published for CVE-2026-22679 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-22679 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22679 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Weaver Network Co., Ltd. E-cology
Sources
Also known as GHSA-vg4v-xjcr-x7p5.