Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API

A critical unauthenticated remote code execution vulnerability in Weaver E-cology enterprise platform (CVE-2026-22679, CVSS 9.8) has been actively exploited since March 17, 2026.

• •The flaw resides in the /papi/esearch/data/devops/dubboApi/debug/method endpoint affecting versions prior to 20260312
• •Attackers craft POST requests with attacker-controlled interfaceName and methodName parameters to execute arbitrary commands
• •Active exploitation shows RCE verification, failed payload drops, MSI implant attempts using "fanwei0324.msi," and PowerShell payload retrieval attempts
• •Attackers executed discovery commands including whoami, ipconfig, and tasklist throughout the campaign
• •Security researchers released Python-based detection scripts to identify vulnerable instances