A critical security vulnerability in the Weaver (Fanwei) E-cology enterprise collaboration platform is now under active exploitation in the wild, posing a significant risk to organizations using affected versions of the software.<\/p>\n
The vulnerability, designated CVE-2026-22679, carries a CVSS score of 9.8 out of a possible 10.0, placing it in the highest category of severity. The flaw relates to a case of unauthenticated remote code execution that affects Weaver E-cology version 10.0 prior to a specific update released on March 12, 2026.<\/p>\n
A senior security researcher at Knownsec disclosed the existence of active exploitation attempts targeting the flaw in a public advisory. The researcher, who uses the handle \u201cDuck,\u201d stated on social media that the vulnerability allows attackers to execute arbitrary commands on the server without requiring any form of authentication.<\/p>\n
The issue resides in the \u201c\/papi\/esearch\/data\/devops\/\u201d endpoint of the platform. This path is part of the software\u2019s Debug<\/a> application programming interface, or API, which is typically used by developers for testing and troubleshooting purposes.<\/p>\n According to the security advisory, the flaw allows an unauthenticated attacker to send specially crafted requests to this API endpoint. When these requests are processed, the server permits unauthorized remote code execution.<\/p>\n Weaver E-cology is a widely deployed office automation suite used primarily in China but also in other markets across Asia. The platform handles a range of administrative functions including document management, workflow approvals, and internal communications, making a compromise potentially damaging for affected organizations.<\/p>\n A CVSS score of 9.8 indicates that the vulnerability is critical and can be Exploited<\/a> remotely with low complexity. The attack vector is over the network, and no user interaction is required to successfully execute an attack.<\/p>\n At the time of the disclosure, no official patch had been issued by Weaver. However, the company released version 20260312, which addresses the vulnerability. Organizations running Weaver E-cology 10.0 are strongly advised to update to this version or later to mitigate the risk.<\/p>\nExploitation and Response<\/h2>\n