CVE-2026-22679

Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

Weaver Network Co., Ltd. E-cology

CVSS

9.3Critical

ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 7 Apr 2026. Not in the KEV catalogCISA via CVE List

Exploit odds (EPSS)20.4%Chance of exploitation activity in the next 30 days, higher than 97% of CVEs. Scored 26 Oct 2026FIRST EPSS

Fixed in20260312Fixed versionCVE List

Published7 Apr 2026Updated 14 Jul 2026CVE List

What fixes it

20260312E-cologyCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

7 Apr 2026, 12:51 UTCPublishedCVE List
26 Oct 2026, 13:05 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

piecar21/CVE-2026-22679: PoC / exploit archive for CVE-2026-22679GitHub proof-of-concept repositories, 26 Oct 2026Exploit code

Description

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).

Text from CVE List

Affected versions 1

E-cologyaffected: all versions before 20260312CVE List