CVE-2026-22679

Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

CVSS 9.3 CRITICALEPSS 21.5%CWE-306

Vexday Risk Score

53Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.3EPSS 21.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

07 Apr 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Weaver Network Co., Ltd. · E-cology

public PoCs found — 1

cve_referenceh4cker.zip/post/d5d211/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://blog.vega.io/posts/cve-2026-22679-weaver-ecology-exploitation/https://h4cker.zip/post/d5d211/https://ti.qianxin.com/vulnerability/notice-detail/1760 https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-rce-via-dubboapi-debug-endpoint https://www.weaver.com.cn/cs/securityDownload.html#