Weaver E-cology critical bug exploited in attacks since March
Critical unauthenticated RCE in Weaver E-cology exploited in attacks since mid-March.
Hackers have been actively exploiting CVE-2026-22679, a critical unauthenticated remote code execution vulnerability in Weaver E-cology office automation software, since mid-March 2026—just five days after the vendor released a patch and two weeks before public disclosure. Threat intelligence researchers at Vega documented multiple attack phases involving reconnaissance commands, failed MSI installer deployments, and obfuscated PowerShell payloads, though attackers failed to establish persistence. The flaw stems from an exposed debug API endpoint that improperly forwards unsanitized user input to backend RPC functionality, allowing arbitrary command execution as the Java/Tomcat process.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Weaver?
Get an email when a new story names Weaver, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited CVE-2026-22679, a critical remote code execution flaw in Weaver E-cology software, just five days after the vendor released a patch. The vulnerability stemmed from an exposed debug API endpoint that forwarded unsanitized user input to backend systems, allowing arbitrary command execution. This incident demonstrates how rapidly threat actors can weaponize newly disclosed vulnerabilities, emphasizing the critical importance of emergency patching procedures and proper secure development practices.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-22679
- malware — fanwei0324.msi
- mitre_attack — T1087
- mitre_attack — T1016
- mitre_attack — T1057