CVE-2026-22679: Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Weaver (Fanwei) E-cology 10.0to a version that resolves this vulnerability.Fixed in 20260312 - Configuration
Disable or restrict the unauthenticated debug functionality on the /papi/esearch/data/devops/dubboApi/debug/method endpoint to prevent command execution via attacker-controlled interfaceName and methodName parameters.
Weaver E-cology dubboApi debug endpoint (/papi/esearch/data/devops/dubboApi/debug/method) debug functionality = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22679?
CVE-2026-22679 has a critical severity rating due to its potential for unauthenticated remote code execution.
How do I fix CVE-2026-22679?
To fix CVE-2026-22679, update Weaver E-cology to version 20260312 or later.
What exploit does CVE-2026-22679 pertain to?
CVE-2026-22679 pertains to an unauthenticated remote code execution vulnerability via the /papi/esearch/data/devops/dubboApi/debug/method endpoint.
Who is affected by CVE-2026-22679?
CVE-2026-22679 affects all versions of Weaver E-cology prior to 20260312.
Can CVE-2026-22679 be exploited remotely?
Yes, CVE-2026-22679 can be exploited remotely without authentication.