E Cology CVE-2026-22679

No special conditions — remote unauthenticated exploitation against Weaver E-cology 10.0 versions prior to 20260312. Attacker sends POST request to /papi/esearch/data/devops/dubboApi/debug/method endpoint with malicious interfaceName and methodName parameters to execute arbitrary commands.

This represents an immediate critical threat requiring emergency remediation. The CVSS 9.8 score accurately reflects severity: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with full impact to confidentiality, integrity, and availability. Confirmed actively exploited (CISA KEV) with Shadowserver Foundation detecting exploitation in the wild starting March 31, 2026, demonstrating adversaries are already weaponizing this vulnerability at scale. Publicly available exploit code (h4cker.zip PoC) lowers the skill barrier for additional threat actors. The SSVC framework would classify this as immediate action required: confirmed exploitation + automatable + total technical impact. Unlike theoretical high-CVSS vulnerabilities, this combines maximum severity scoring with confirmed real-world exploitation and commoditized exploit availability. Organizations running affected E-cology versions face imminent risk of full system compromise, data theft, ransomware deployment, and lateral movement within enterprise networks.

An external attacker scans the internet for publicly accessible Weaver E-cology instances and identifies the vulnerable /papi/esearch/data/devops/dubboApi/debug/method endpoint. Using the publicly available exploit code from h4cker.zip, the attacker crafts a POST request with interfaceName pointing to a Java Runtime class and methodName targeting exec() or similar command-execution methods, passing operating system commands as parameters. The server executes these commands with the privileges of the E-cology application process, granting the attacker immediate code execution. The attacker then deploys a web shell for persistent access, exfiltrates sensitive enterprise data including employee records and financial information, establishes lateral movement to connected systems via stolen credentials, and potentially deploys ransomware across the corporate network. Given the authentication bypass and network accessibility, exploitation requires minimal technical sophistication and can be fully automated for mass scanning campaigns.