Threat Intelligence / CVE / CVE-2026-22679

CVE-2026-22679

CVSS 9.8 (CRITICAL) · EPSS 0.3% · Priority 7/10 · Published 2026-04-07

As of 2026-05-05, CVE-2026-22679 is a CVSS 9.8 (CRITICAL-severity) vulnerability. EPSS exploitation probability 0.3%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2026-05-05

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-306

Threats tracking this CVE

Weaver E-cology Unauthenticated RCE (CVE-2026-22679) — Active Exploitation Since Mid-March 2026 via dubboApi Debug Endpoint — CRITICAL

References

Full detection coverage & IOCs for threats exploiting CVE-2026-22679 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.