Weaver E-cology Unauthenticated RCE (CVE-2026-22679) — Active Exploitation Since Mid-March 2026 via dubboApi Debug Endpoint — Threadlinqs Intelligence
As of 2026-05-30, Weaver E-cology Unauthenticated RCE (CVE-2026-22679) — Active Exploitation Since Mid-March 2026 via dubboApi Debug Endpoint is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0455 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
CVE-2026-22679 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in Weaver (Fanwei) E-cology 10.0 builds prior to 20260312, caused by an exposed Dubbo RPC debug endpoint at
## Overview
CVE-2026-22679 is an unauthenticated remote code execution vulnerability affecting Weaver E-cology 10.0 (all builds prior to 20260312). E-cology, developed by Shanghai Weaver Network Co. Ltd. (泛微 / Fanwei), is one of the most widely deployed enterprise office automation (OA) and collaboration platforms in mainland China, used across government agencies, state-owned enterprises, banks and insurance firms, large private corporations, and universities. The product bundles document management, workflow automation, HR, messaging, calendaring, and portal services on top of an embedded Tomcat/JBoss container running a Java application with the Apache Dubbo RPC framework underneath.
The vulnerability resides in a development/diagnostics endpoint that was inadvertently shipped to production: `/papi/esearch/data/devops/dubboApi/debug/method`. This endpoint accepts unauthenticated HTTP POST requests and parses two attacker-controlled string parameters — `interfaceName` (a fully-qualified Dubbo interface class) and `methodName` (the method to invoke on that interface) — alongside a `parameters` array. The handler then resolves the requested interface/method via the Dubbo RPC layer and invokes it with the supplied parameters. Because the dispatch logic enforces no authentication, no allow-list of safe interfaces or methods, no parameter type checking, and no input sanitization, an attacker can pivot the endpoint into arbitrary OS command execution by selecting a command-execution helper class exposed to the RPC registry. The resulting child process inherits the privileges of the Weaver service account, which on Windows installations is typically a SYSTEM-level service account and on Linux installations is frequently root or a high-privileged service user.
## Root Cause and Exploitation Mechanics
The vendor patch released on 2026-03-12 simply removes the entire `/papi/esearch/data/devops/dubboApi/debug/method` route — there is no allow-list refactor or authentication wrapper, indicating the endpoint had no production purpose. NVD primary CWE classification is CWE-306 (Missing Authentication for Critical Function); third-party analysis additionally maps the issue to CWE-94 (Improper Control of Generation of Code) because attacker input directly drives RPC method selection.
An exploitation request looks like:
```
POST /papi/esearch/data/devops/dubboApi/debug/method HTTP/1.1
Host: <target>
Content-Type: application/json
{"interfaceName": "com.weaver.rpc.<command-helper-class>",
"methodName": "<exec-method>",
"parameters": ["<command>", "<arg1>", "<arg2>"]}
```
Because the request is a single unauthenticated POST and the response surface is shaped like a routine API call, exploitation traffic blends easily into normal application logs unless defenders explicitly look for the path.
## Observed Campaign (Vega Threat Intelligence)
Vega documented at least one extended campaign lasting roughly a week per targeted organization with several distinct phases. Each campaign began approximately 2026-03-17, only five days after Weaver's silent patch — a tempo that strongly suggests patch-diff exploit development by a capable, organized actor that monitors the vendor's official patch portal (https://www.weaver.com.cn/cs/securityDownload.html).
Phase 1 — Capability Probe: attackers issued ICMP `ping` commands from the Java process to a Goby-linked callback infrastructure to confirm RCE primitive worked end-to-end. Goby is a Chinese-language vulnerability scanner heavily used by both red teams and threat actors operating in the Sinophone space.
Phase 2 — PowerShell Payload Download: attackers issued obfuscated and fileless PowerShell commands (e.g., `powershell.exe -nop -w hidden -enc <base64>` style) to fetch follow-on payloads from external infrastructure. These were repeatedly blocked by endpoint defenses on the targets Vega observed.
Phase 3 — MSI Installer Deployment: after PowerShell failures, attackers attempted to deliver a
Weaknesses (CWE)
CWE-306, CWE-94, CWE-749
Target sectors: government, financial, banking, insurance, education, higher-education, manufacturing, energy, telecommunications, state-owned-enterprise
Target regions: China, Hong Kong, Taiwan, Asia-Pacific
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-22679, T1595, T1595.002, T1583, T1608.001, T1190, T1059.001, T1059.003, T1569.002, T1204, T1027