Weaver E-cology Under Attack: Critical RCE Exploited via Debug Endpoint

CVE-2026-22679 in Weaver E-cology allows unauthenticated RCE via an exposed debug API. With active exploitation documented since March 17 and a CVSS score of 9…

Weaver E-cology Under Attack: Critical RCE Exploited via Debug Endpoint

Unidentified threat actors are actively weaponizing CVE-2026-22679, a critical vulnerability in Weaver E-cology 10.0 that allows remote code execution (RCE) through an unauthenticated debug API endpoint. Evidence of exploitation surfaced as early as March 17, 2026—less than a week after a security patch was released. For enterprises relying on this ERP/OA platform, the combination of an unauthenticated attack vector and a CVSS score of 9.8 necessitates an immediate response.

Key Takeaways
  • The /papi/esearch/data/devops/dubboApi/debug/method endpoint permits RCE via POST requests by manipulating interfaceName and methodName parameters to trigger internal command execution helpers.
  • The Vega Research Team identified evidence of abuse starting March 17, 2026, just days after the release of corrective build 20260312.
  • The Shadowserver Foundation began detecting active exploitation attempts across its global sensor network on March 31, 2026.
  • Observed post-exploitation activity includes discovery commands like whoami, ipconfig, and tasklist, alongside failed attempts to deploy an MSI installer named fanwei0324.msi.

The DubboApi Attack Vector: From Debug to RCE

The vulnerability centers on a debug endpoint associated with the DubboApi framework, located at the path /papi/esearch/data/devops/dubboApi/debug/method. In Weaver E-cology 10.0 installations lacking the 20260312 build, this interface fails to enforce authentication, allowing any remote user to send POST requests with arbitrary parameters. Researchers confirmed that the interfaceName and methodName parameters can be routed to internal execution helpers, facilitating unauthenticated RCE with a critical severity rating.

"Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system." — NIST National Vulnerability Database (NVD), as cited by The Hacker News

Rapid Weaponization: Exploitation Within Days of Patching

While CVE-2026-22679 was addressed in build 20260312, the window between patch availability and documented abuse was remarkably short. The Vega Research Team found traces of active exploitation as early as March 17, 2026. This rapid turnaround suggests that threat actors either performed swift diff-analysis of the patch or were already aware of the vulnerability prior to its public disclosure.

The Shadowserver Foundation, which monitors global internet threat telemetry, reported its first hits on this vulnerability starting March 31, 2026. While the total volume of compromised systems remains unconfirmed, the gap between the initial discovery and wider sensor detection indicates a campaign that is steadily expanding. The identity of the threat actor remains unknown, and it is unclear if the exploit has been integrated into public kits or remains limited to specialized operations.

Post-Exploitation: Reconnaissance and Failed MSI Payloads

Once initial access is achieved, attackers move quickly beyond simple verification. According to Vega Research Team reports, intrusions have involved internal reconnaissance using standard system tools such as whoami, ipconfig, and tasklist. This behavior follows a standard discovery pattern used to map the compromised environment for further lateral movement.

Intruders also attempted to deploy an MSI installer labeled fanwei0324.msi (a romanization of the vendor name, Fanwei). While the file was intended to establish a foothold or facilitate pivoting, it reportedly failed to produce a functional installation. It remains unclear whether this failure was due to a flawed payload, environmental security controls, or configuration incompatibilities; however, the attempt clearly demonstrates an intent to establish persistence via artifacts disguised as legitimate software.

The ERP Blind Spot: Why Debug Endpoints Are High-Risk

This incident highlights a recurring vulnerability pattern in enterprise platforms: developmental or debug endpoints left active in production environments. In Weaver E-cology, the DubboApi debug interface—intended for internal troubleshooting—becomes a critical entry point when exposed to the public internet. Because ERP and Office Automation (OA) systems centralize sensitive data, an unauthenticated RCE can have devastating consequences for operational integrity.

The risk extends beyond the CVSS score. Because the vulnerable endpoint requires no credentials, it bypasses traditional perimeter defenses. Without robust network segmentation, the compromise of a single exposed node can grant attackers a path into document repositories, internal databases, and corporate authentication systems.

Remediation and Defensive Measures

  • Apply Patch 20260312: Update all Weaver E-cology 10.0 instances immediately, bypassing standard maintenance windows if necessary due to active exploitation.
  • Restrict Endpoint Access: Verify the exposure of /papi/esearch/data/devops/dubboApi/debug/method. If public access is not required, block the path via firewall or Web Application Firewall (WAF).
  • Audit POST Requests: Inspect logs for anomalous POST requests to the DubboApi path, specifically looking for unusual interfaceName and methodName parameters.
  • Conduct Threat Hunting: Scan for unauthorized executions of whoami, ipconfig, or tasklist originating from the application server context, and check for the presence of fanwei0324.msi or connections to suspicious external infrastructure.

Leaving a debug endpoint exposed in a production ERP environment is effectively leaving a backdoor open. In an era where attackers can weaponize patches in days, the security of enterprise systems depends as much on reducing the attack surface as it does on timely patching.

Frequently Asked Questions

Why is there a discrepancy between the detection dates from Vega (March 17) and Shadowserver (March 31)?
The Vega Research Team identified the earliest documented evidence of abuse in specific environments, while Shadowserver reported when the activity became visible across its broader sensor network. These dates suggest a campaign that began in a targeted fashion before expanding.
Why did the fanwei0324.msi installer fail?
According to researchers, the payload did not result in a working installation. The cause remains unknown but could range from technical errors in the payload to effective host-based security measures on the target systems.
Is patching to build 20260312 sufficient, or should the debug endpoint be disabled entirely?
The patch is the primary requirement for security. However, as a best practice, debug and development endpoints should never be reachable from the public internet, regardless of their patch status.

Information verified against cited sources and current as of the date of publication.

Sources