Which versions of E Cology are affected by CVE-2026-22679?

Weaver E-cology 10.0 contains a critical unauthenticated remote code execution vulnerability in debug endpoints that enables attackers to execute arbitrary system commands without authentication.. A patch is available.

Is there a public PoC exploit available for CVE-2026-22679?

Yes, a public proof-of-concept exploit is available for CVE-2026-22679. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-22679?

Within 24 hours: Identify all instances of Weaver E-cology 10.0 (pre-20260312) in your environment and isolate them from production traffic if patching cannot be completed immediately. Within 7 days: Apply vendor-released patch to upgrade all affected instances to version 20260312 or later; verify patch deployment across all systems. Within 30 days: Conduct forensic review of server logs for /papi/esearch/data/devops/dubboApi/debug/method access patterns and any suspicious POST requests with interfaceName or methodName parameters to identify potential compromise; implement network segmentation to restrict access to debug endpoints.

E Cology CVE-2026-22679

Q: What is the CVSS score of CVE-2026-22679?

CVE-2026-22679 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-19607 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-04-07 VulnCheck

GHSA-vg4v-xjcr-x7p5

RCE Authentication Bypass E Cology

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 15:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

20260312

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 07, 2026 - 13:00 euvd

EUVD-2026-19607

Analysis Generated

Apr 07, 2026 - 13:00 vuln.today

CVE Published

Apr 07, 2026 - 12:51 nvd

CRITICAL 9.3

DescriptionCVE.org

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).

Articles & Coverage 2

medium.com CVE-2026-22679: Unauthenticated RCE via Debug Endpoint in Weaver E-cology Apr 16, 2026 POC CVE-2026-22679: Weaver E-cology Unauthenticated RCE via dubboApi Debug Endpoint (CVSS 9.3) Apr 16, 2026

AnalysisAI

Unauthenticated remote code execution in Weaver E-cology 10.0 (pre-20260312) allows attackers to execute arbitrary system commands via exposed debug functionality at /papi/esearch/data/devops/dubboApi/debug/method. Attackers exploit this by sending crafted POST requests with malicious interfaceName and methodName parameters to invoke command-execution helpers. Confirmed actively exploited (CISA KEV) with exploitation first observed by Shadowserver Foundation on March 31, 2026. Publicly available exploit code exists (h4cker.zip PoC), CVSS 9.8 (Critical), EPSS data not provided but real-world exploitation confirmed.

Technical ContextAI

This vulnerability affects Weaver E-cology 10.0, an enterprise collaboration and office automation platform widely deployed in Chinese organizations (CPE: cpe:2.3:a:weaver_network_co.,_ltd.:e-cology). The root cause is CWE-306 (Missing Authentication for Critical Function), where a Dubbo API debug endpoint at /papi/esearch/data/devops/dubboApi/debug/method lacks authentication controls and exposes dangerous debugging functionality to the public network. Dubbo is a popular Java RPC framework, and debug endpoints typically allow method invocation for troubleshooting. In this case, the interfaceName and methodName parameters accept attacker-controlled input that can reference internal command-execution utility classes, effectively turning the debug interface into a remote shell. The vulnerability bypasses all authentication mechanisms, making it directly exploitable from the internet without credentials.

RemediationAI

Immediately upgrade to Weaver E-cology 10.0 version 20260312 or later, which addresses this vulnerability according to the vendor security download page (https://www.weaver.com.cn/cs/securityDownload.html). Given confirmed active exploitation, this patch should be treated as an emergency deployment with priority over standard change management procedures. If immediate patching is not feasible, implement network-level controls to block external access to the /papi/esearch/data/devops/dubboApi/debug/* endpoint path using web application firewalls or reverse proxies, and restrict E-cology administrative interfaces to trusted internal networks only. Conduct forensic investigation on all E-cology instances to identify potential compromise indicators, including unusual process execution, unauthorized user accounts, web shell artifacts, or suspicious outbound network connections since March 31, 2026. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-rce-via-dubboapi-debug-endpoint) for additional technical indicators of compromise and detection guidance.