CVE-2026-22679
Published: 07 April 2026
Summary
CVE-2026-22679 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Weaver E-Cology. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-22679 is an unauthenticated remote code execution vulnerability in Weaver (Fanwei) E-cology 10.0 versions prior to 20260312. The issue stems from exposed debug functionality in the /papi/esearch/data/devops/dubboApi/debug/method endpoint, which allows attackers to execute arbitrary commands. Exploitation occurs via crafted POST requests using attacker-controlled interfaceName and methodName parameters to invoke command-execution helpers, as classified under CWE-306 (Missing Authentication for Critical Function). The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers require only network access and need no authentication, privileges, or user interaction to exploit the endpoint. Successful exploitation grants arbitrary command execution on the affected system, enabling full compromise including data exfiltration, persistence, or further lateral movement.
Advisories from VulnCheck, QiAnXin Threat Intelligence, and others, including exploitation details and PoCs, are available at referenced URLs such as https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-rce-via-dubboapi-debug-endpoint and https://ti.qianxin.com/vulnerability/notice-detail/1760. Weaver provides patches via their security download page at https://www.weaver.com.cn/cs/securityDownload.html#.
Exploitation evidence was first observed in the wild by the Shadowserver Foundation on 2026-03-31 (UTC), ahead of CVE publication on 2026-04-07T13:16:45.400.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19607
Vulnerability details
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and…
more
methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated RCE vulnerability in a public-facing web application endpoint (/papi/esearch/data/devops/dubboApi/debug/method) via crafted POST requests, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely flaw remediation, including application of Weaver-provided patches that eliminate the unauthenticated RCE vulnerability in the debug endpoint.
Limits permitted actions without identification or authentication, directly prohibiting unauthenticated access to the exposed debug endpoint enabling arbitrary command execution.
Enforces approved access control policies and associated access enforcements, preventing unauthorized POST requests to the vulnerable /debug/method endpoint.