CVE-2026-22679, a critical remote code execution bug in Weaver (Fanwei) E-cology, carries a CVSS score of 9.8 and is under active exploitation in the wild.
The vulnerability: unauthenticated RCE via the debug API
The flaw affects Weaver E-cology 10.0 versions prior to 20260312 and resides in the exposed debug endpoint at "/papi/esearch/data/devops/dubboApi/debug/method." According to the NIST National Vulnerability Database (NVD), the endpoint permits unauthenticated command execution: "Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system." The severity rating — CVSS 9.8 — reflects the potential for full system compromise without authentication.
Observed timeline: detection, reproduction, and early abuse
Multiple organizations reported activity around the vulnerability in March 2026. Chinese security vendor QiAnXin said it successfully reproduced the remote code execution on March 17, 2026. The Shadowserver Foundation observed the first signs of active exploitation on March 31, 2026. In a report published last week, the Vega Research Team attributed active exploitation to the flaw and placed the earliest evidence of abuse at March 17, 2026 — notably five days after patches were shipped for the flaw.
Attack activity and artifacts documented by Vega Research Team
Vega Research Team security researcher Daniel Messing summarized the intrusion as a roughly week-long sequence of operator actions: "RCE verification, three failed payload drops, an attempted pivot to an MSI implant that did not produce a working install, and a short burst of attempts to retrieve PowerShell payloads from attacker-controlled infrastructure." The MSI installer was observed using the filename "fanwei0324.msi," an apparent attempt to masquerade as a legitimate Weaver-related file. Throughout the campaign the unknown operator executed discovery commands such as whoami, ipconfig, and tasklist.
Detection and mitigation: scripts and updates
Detection and remediation options have been made available alongside public reporting. Security researcher Kerem Oruc released a Python-based detection script that identifies Weaver E-cology instances with the vulnerable API endpoint accessible. Users are explicitly advised to apply available updates if they have not already done so; the vulnerability affects versions prior to the 20260312 release marker.
How security teams, affected enterprises, and end users should respond
- Security teams: verify whether any internal or customer-facing Weaver E-cology 10.0 instances match the vulnerable version string (prior to 20260312) and check accessibility of the "/papi/esearch/data/devops/dubboApi/debug/method" endpoint. Employ Kerem Oruc’s detection script where operationally appropriate and review logs for the behaviors Vega documented — RCE verification attempts, failed payload drops, requests for PowerShell payloads, and execution of discovery commands.
- Affected enterprises and procurement leaders: prioritize application of the vendor-supplied updates for Weaver E-cology 10.0, validate patch deployment across environments, and consider post-patch forensics for systems that were internet-accessible between March 17 and March 31, 2026, when early exploitation activity was observed.
- End users and administrators: restrict external access to administrative or debug endpoints where possible, and report any unexpected MSI installers (for example, files named "fanwei0324.msi") or unexplained command activity to incident response teams.
The record in public reporting is straightforward: a severe, unauthenticated debug API in Weaver E-cology enabled remote command execution; proof-of-concept reproduction and active exploitation were observed in March 2026; and investigators documented an attempted deployment cycle that included staged payloads and discovery commands. Patches exist and detection tooling is available, but the Vega Research Team’s findings — including the use of a plausibly named MSI and attempts to retrieve further payloads — underscore that operators moved quickly after the flaw became public. A central, practical question remains for organizations using Weaver E-cology: have all internet-exposed instances been updated and scanned for signs of the specific attacker behaviors recorded here?
Original reporting: thehackernews.com — Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API
