Critical Alert: CVE-2026-22679 at Weaver E-cology exposes a debugging endpoint and allows remote command execution

A critical failure in the Weaver Eco-cology office automation platform (identified as CVE-2026-22679) has been actively exploited since mid-March to execute discovery commands on compromised servers, according to the follow-up published by the Vega intelligence firm. The root of the problem is a debugging endpoint exposed that passes unvalidated parameters to the backend RPC functionality, which allows to convert that interface into a remote system-level command execution mechanism.

The panorama that Vega describes reveals several phases of attack: initial remote execution checks (by pings to callbacks associated with the Goby tool), attempts to download payloads by PowerShell osfuscado, the failed deployment of a directed MSI installer (fanwei0324.msi) and return to phileless techniques that repeatedly brought and executed remote scripts. Although in documented cases the endpoints defenses intervened and no established persistence was reached, the technical capacity to run commands such as whoami, ipconfig or tasklist from Java processes without authentication makes operational risk evident.

A critical data of the chronology: the attacks began a few days after the supplier published an update (build 20260312) and before the vulnerability was widely made public, which highlights two lessons: first, that the published updates are useless if not quickly applied; and second, that the availability of a patch does not prevent actors from looking for hosts without parking by taking advantage of prior technical information or the exposure surface itself.

The supplier removed the treatment endpoint in the grinding building, and the official recommendation is clear: update to the corrected version as soon as possible. You can find the patch and the manufacturer's bulletin on the Weaver page: Weaver safety notice (build 20260312). The technical analysis and timeline published by researchers is available in Vega's report: Vega analysis of CVE-2026-22679. For a priority framework and practices for responding to actively exploited vulnerabilities, see the CISA catalogue of exploited vulnerabilities: CISA KEV.

If your organization uses Weaver E-cology 10.0 or versions prior to 12 March 2026, the first mandatory action is to check the inventory and apply the correct build immediately. Beyond the patch, it is essential to validate that the update was applied correctly and to look for compromise indicators: review web server logs for applications to the old debugging endpoint, search for suspicious parameters in RPC requests, and events where java.exe processes act as cmd.exe parents, powershell.exe or other unexpected processes.

Practical detections should include the search for obfuscated PowerShell command lines, repeated calls to external domains or beacons DNS / TCP and devices related to the reported malicious installer (e.g. fanwei0324.msi references). In EDR environments, create rules to warn about child processes from the server's JVM (embedded Tomcat) that run system tools or that download and run scripts from remote locations.

From an architectural point of view, this vulnerability is a call for attention to implement preventive controls: restrict or remove endpoints of purification in production, apply the principle of less privilege to accounts and processes, segment networks to limit lateral movement capacity and subject critical endpoints to implementation control and output filtering policies. If it is not possible to park immediately, mitigate exposure by restricting access to the port or vulnerable endpoint through access control lists, reverse proxies or WAF, although the final correction should be the official update.

Finally, if you detect signs of exploitation or have reason to believe that a host was reached, activate the incident response plan: contain the affected system, preserve logs and memory for forensic analysis, assess the possibility of complete remediation (re-installation if contamination exists), and communicate to interested parties according to applicable regulations. The absence of persistence in documented cases does not guarantee that future attackers do not try to consolidate access; therefore, continuous monitoring and proactive search in the server park are essential.