[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8THI-RFDluu8X8Y87kVshjGkVsHUuLXRviLbHGJgMZU":3},{"article":4,"iocs":49,"watch_terms":68,"solutions":69,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"fd94932b-eb6c-4165-9d1b-80d55bc13161","Weaver E-cology critical bug exploited in attacks since March","weaver-e-cology-critical-bug-exploited-in-attacks-since-march-0a1b8c","Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mid-March to run discovery commands. [...]","Hackers have been actively exploiting CVE-2026-22679, a critical unauthenticated remote code execution vulnerability in Weaver E-cology office automation software, since mid-March 2026—just five days after the vendor released a patch and two weeks before public disclosure. Threat intelligence researchers at Vega documented multiple attack phases involving reconnaissance commands, failed MSI installer deployments, and obfuscated PowerShell payloads, though attackers failed to establish persistence. The flaw stems from an exposed debug API endpoint that improperly forwards unsanitized user input to backend RPC functionality, allowing arbitrary command execution as the Java\u002FTomcat process.","Critical unauthenticated RCE in Weaver E-cology exploited in attacks since mid-March.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fweaver-e-cology-critical-bug-exploited-in-attacks-since-march\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F03\u002F25\u002FHacker.jpg","2026-05-04T22:12:57+00:00","2026-05-05T00:00:19.994189+00:00",9,[17,20,23,25],{"name":18,"type":19},"Weaver E-cology","product",{"name":21,"type":22},"Weaver","vendor",{"name":24,"type":22},"Vega",{"name":26,"type":27},"Java\u002FTomcat","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,58,62,65],{"type":51,"value":52,"context":53},"cve","CVE-2026-22679","Critical unauthenticated RCE in Weaver E-cology 10.0 prior to build 20260312",{"type":55,"value":56,"context":57},"malware","fanwei0324.msi","Target-aware MSI installer payload attempted by attackers; execution failed",{"type":59,"value":60,"context":61},"mitre_attack","T1087","Account discovery via whoami commands",{"type":59,"value":63,"context":64},"T1016","System network configuration discovery via ipconfig",{"type":59,"value":66,"context":67},"T1057","Process discovery via tasklist commands",[21,24,18],{"controls":70,"vendors":158},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":101,"name":102,"problem":103,"products":104},"patch-management","Automated patch management","Known holes get closed in days, not months.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":130,"name":131,"problem":132,"products":133},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[159],{"slug":160,"name":24,"logo_path":161,"roles":162},"vega","\u002Fvendor-logos\u002Fvega.png",[163],"reported_by",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":174},"critical-rce-vulnerability-in-weaver-e-cology-exploited-within-days-of-patch-release","Critical RCE Vulnerability in Weaver E-cology Exploited Within Days of Patch Release","Attackers exploited CVE-2026-22679, a critical remote code execution flaw in Weaver E-cology software, just five days after the vendor released a patch. The vulnerability stemmed from an exposed debug API endpoint that forwarded unsanitized user input to backend systems, allowing arbitrary command execution. This incident demonstrates how rapidly threat actors can weaponize newly disclosed vulnerabilities, emphasizing the critical importance of emergency patching procedures and proper secure development practices.",[169,170,171,172,173],"CIS Control 7 (Malware Defenses)","NIST SI-2 (Flaw Remediation)","NIST CM-6 (Configuration Settings)","OWASP ASVS 14.2 (Out of Band Communications)","ISO 27001 A.12.6.1 (Management of technical vulnerabilities)",{}]