Full Report
Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mid-March to run discovery commands. [...]
Analysis Summary
# Vulnerability: Unauthenticated RCE in Weaver E-cology via Debug API
## CVE Details
- **CVE ID:** CVE-2026-22679
- **CVSS Score:** 9.8 (Critical) - *Estimated based on unauthenticated RCE impact*
- **CWE:** CWE-94 (Improper Control of Generation of Code) / CWE-74 (Injection)
## Affected Systems
- **Products:** Weaver E-cology (Enterprise Office Automation platform)
- **Versions:** E-cology 10.0 builds prior to March 12, 2026.
- **Configurations:** Systems exposing the web-based office automation interface to the internet or untrusted networks.
## Vulnerability Description
The flaw resides in an exposed debug API endpoint that fails to implement authentication or input validation. This endpoint improperly passes user-supplied parameters to backend Remote Procedure Call (RPC) functionality. An attacker can submit crafted values that are processed by the underlying Java Virtual Machine (JVM), leading to arbitrary system command execution on the host server.
## Exploitation
- **Status:** Exploited in the wild (Detected since mid-March 2026).
- **Complexity:** Low (No authentication required; exploitation involves simple HTTP requests to a debug endpoint).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Total (Full access to files, HR data, and system reconnaissance).
- **Integrity:** Total (Ability to execute commands, modify system files, and download malicious MSI or PowerShell payloads).
- **Availability:** High (Potential for system disruption or deployment of destructive malware).
## Remediation
### Patches
- **Weaver E-cology 10.0 Build 20260312:** This update remediates the flaw by entirely removing the vulnerable debug endpoint.
- Availability: Users should download updates from the official vendor site: `https[:]//www.weaver.com.cn/cs/security/edm20260312_opzuyukeiouit0312topeywer.html`
### Workarounds
- No official workarounds are available. Immediate patching is the only recommended course of action.
- Temporary Mitigation: Restrict access to the Weaver E-cology web interface via IP whitelisting or VPN to reduce the attack surface.
## Detection
- **Indicators of Compromise (IoCs):**
- Parent Process: `java.exe` (Weaver’s Tomcat-bundled JVM) spawning suspicious child processes such as `cmd.exe`, `powershell.exe`, `whoami`, `ipconfig`, or `tasklist`.
- File Artifacts: Presence of `fanwei0324.msi` or unexpected PowerShell scripts in temp directories.
- Network Traffic: Ping commands directed toward Goby-linked callback domains or external IP addresses from the E-cology server.
- **Detection Methods:**
- Monitor web server logs for requests to debug-related API endpoints (RPC/Debug).
- Use EDR/SIEM tools to flag unauthenticated system commands originating from the `java.exe` process.
## References
- Weaver Security Bulletin: `https[:]//www.weaver.com.cn/cs/security/edm20260312_opzuyukeiouit0312topeywer.html`
- Vega Intelligence Report: `https[:]//blog.vega.io/posts/cve-2026-22679-weaver-ecology-exploitation/`
- BleepingComputer Article: `https[:]//www.bleepingcomputer.com/news/security/weaver-e-cology-critical-bug-exploited-in-attacks-since-march/`