Loading story…
Weaver (Fanwei) E-cology deployments are affected by two high-severity vulnerabilities that allow unauthenticated attackers to compromise exposed servers. CVE-2026-22679 impacts E-cology 10.0 versions prior to 20260312 and enables remote code execution through the /papi/esearch/data/devops/dubboApi/debug/method endpoint, where attacker-controlled interfaceName and methodName POST parameters can abuse exposed debug functionality to run arbitrary commands. The issue is classified as CWE-306 and carries high impact across confidentiality, integrity, and availability, with exploitation observed in the wild by the Shadowserver Foundation.
A second flaw, CVE-2022-50992, affects E-cology 9.5 versions prior to 10.52 and allows unauthenticated arbitrary file reads through the XmlRpcServlet XML-RPC interface. Attackers can supply file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods to retrieve sensitive files from the server, including configuration data and database credentials. The vulnerability is mapped to CWE-22, and Shadowserver reported exploitation evidence dating back to 2022, underscoring continued exposure risk for internet-facing E-cology systems that remain unpatched.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
VulnCheck's disclosure channel newly received CVE-2022-50992 on April 30, 2026. The vulnerability affects Weaver E-cology 9.5 versions prior to 10.52.
A GitHub repository published technical analysis for CVE-2026-22679, including proof-of-concept details for unauthenticated RCE via the exposed debug endpoint, plus indicators of compromise and detection guidance. The material also outlined mitigation steps such as blocking the endpoint, restricting exposure, and reviewing logs and hosts for compromise.
VulnCheck's disclosure channel newly received CVE-2026-22679 on April 7, 2026. The vulnerability affects Weaver E-cology 10.0 versions prior to 20260312.
The Shadowserver Foundation first observed exploitation of CVE-2026-22679, an unauthenticated remote code execution vulnerability in Weaver E-cology 10.0's /papi/esearch/data/devops/dubboApi/debug/method endpoint. The issue can be abused through attacker-controlled interfaceName and methodName parameters to execute arbitrary commands.
Vega Research Team reported evidence that CVE-2026-22679 was being exploited as early as March 17, 2026, shortly after Weaver released build 20260312. The activity involved multi-stage intrusion attempts following unauthenticated RCE via the exposed debug API endpoint.
Weaver released build 20260312 for E-cology 10.0 in mid-March 2026, removing the exposed debug API endpoint that enabled unauthenticated remote code execution via CVE-2026-22679. The report says attackers began exploiting the flaw shortly after this fix was released and before public disclosure.
The Shadowserver Foundation first observed exploitation of CVE-2022-50992, an unauthenticated arbitrary file read vulnerability in Weaver E-cology 9.5's XmlRpcServlet XML-RPC endpoint. The flaw allows remote attackers to read arbitrary files, including sensitive configuration files and database credentials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
10 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcecvefeed.io
Open sourceblog.vega.io
Open sourcegithub.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two critical server-side vulnerabilities have exposed widely deployed web applications to full remote compromise without authentication. In **AVideo**, `CVE-2025-34433` was rated **CVSS 10.0** after researchers reported a deterministic cryptographic failure that enables immediate remote code execution during normal HTTP request processing. Successful exploitation can grant attackers the privileges of the web server process, with broad read and write access to the application directory, internal database, and uploaded media, creating a complete confidentiality, integrity, and availability failure. The flaw is considered highly reliable because it does not depend on memory corruption and is not meaningfully hindered by mitigations such as ASLR, DEP, or stack canaries; reports also noted the existence of weaponized exploit modules. A separate **actively exploited** flaw, `CVE-2026-22679`, affects **Weaver (Fanwei) E-cology 10.0** builds before `20260312`. The vulnerability stems from an exposed debug endpoint that forwards attacker-controlled JSON into the **Dubbo RPC** framework without authentication or validation, allowing arbitrary operating system command execution through the Java application running under **Tomcat**. Threat intelligence tied exploitation to internet-facing systems shortly after the vendor patch, with observed activity including `ping`-based verification, PowerShell payload retrieval, attempted MSI deployment, and evasive techniques such as renamed PowerShell binaries and in-memory execution. Defenders were urged to upgrade affected systems, watch for suspicious child processes spawned by `java.exe`, and review EDR telemetry for obfuscated or fileless post-exploitation behavior.
Jun 29, 2026
IBM disclosed multiple high-severity vulnerabilities affecting **WebSphere** and **webMethods Integration Server**, exposing enterprise middleware environments to remote compromise. In WebSphere, the reported issues include remote code execution flaws tracked as `CVE-2026-9311`, `CVE-2026-9330`, and `CVE-2026-9319`, alongside an authentication bypass and identity spoofing issue, `CVE-2026-8644`. Affected deployments include traditional WebSphere versions **9.0** and **8.5**, with IBM issuing interim fixes through specific APARs and urging administrators to verify configurations and apply patches quickly. A separate IBM advisory covers **webMethods Integration Server** `CVE-2025-36072`, a deserialization-based remote code execution flaw that can be exploited by an authenticated attacker with service execution privileges through internal APIs or protocols such as `IDataBin`. The vulnerability affects versions **10.11** through `10.11_Core_Fix22`, **10.15** through `10.15_Core_Fix22`, and **11.1** through `11.1_Core_Fix6` if they have not received the latest core fixes. Successful exploitation could allow arbitrary code execution in the Integration Server process, enabling lateral movement, persistence, and data exfiltration across business-critical systems.
Jun 29, 2026
Government cyber agencies in Belgium and Canada warned of a **critical unauthenticated OS command injection** vulnerability in *IceWarp* (tracked as **CVE-2025-14500**, **CVSS 9.8**) that can allow a remote attacker to execute arbitrary commands on affected servers. The flaw is described as **CWE-78** and is tied to improper validation of user-controlled input in the `X-File-Operation` HTTP header, enabling code execution with high privileges (e.g., **SYSTEM** on Windows or **root** on Linux), with severe impact to confidentiality, integrity, and availability. Both advisories urge immediate patching across impacted IceWarp product lines and versions, including *IceWarp Epos Update 2*, *Epos Update 1*, *Epos (1st generation)*, and *Deep Castle and older versions*. Recommended fixed versions include upgrading to **14.2.0.12+** (Epos Update 2), **14.1.0.20+** (Epos Update 1), **14.0.0.18+** (Epos 1st gen), and **13.0.3.13+** (Deep Castle/older), alongside heightened monitoring and detection while remediation is underway.
Jun 29, 2026