Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API

The Hacker News

May 5, 2026 at 7:37 AM

Actively Exploited

Overview

A serious vulnerability has been discovered in Weaver E-cology, an enterprise office automation platform. This flaw, identified as CVE-2026-22679, allows attackers to execute code remotely without authentication. It affects versions of Weaver E-cology prior to 10.0.20260312 and has a high severity score of 9.8, indicating its potential for significant impact. The issue is actively being exploited in the wild, putting users and organizations at risk of unauthorized access and control over their systems. Companies using this software should prioritize updating to the latest version to protect against these attacks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Weaver E-cology versions prior to 10.0.20260312.
Action Required: Users should update Weaver E-cology to version 10.
Timeline: Newly disclosed

Original Article Summary

A critical security vulnerability in Weaver (Fanwei) E-cology, an enterprise office automation (OA) and collaboration platform, has come under active exploitation in the wild. The vulnerability (CVE-2026-22679, CVSS score: 9.8) relates to a case of unauthenticated remote code execution affecting Weaver E-cology 10.0 versions prior to 20260312. The issue resides in the "/papi/esearch/data/devops/

Impact

Weaver E-cology versions prior to 10.0.20260312.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should update Weaver E-cology to version 10.0.20260312 or later to mitigate the vulnerability.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, RCE, and 1 more.

Read Original Article

Related Coverage

NCSC Warns of an AI-Fuelled “Vulnerability Patch Wave”

Infosecurity Magazine

The UK's National Cyber Security Centre (NCSC) is warning organizations to brace for a wave of new software updates driven by advancements in artificial intelligence. This surge in updates is expected as developers respond to newly discovered vulnerabilities that AI tools can help identify more efficiently. The NCSC emphasizes that businesses and institutions need to ensure their systems are up-to-date to protect against potential security threats that exploit these vulnerabilities. With the growing reliance on software across various sectors, timely patching becomes crucial to maintain cybersecurity. Organizations are encouraged to review their update policies and prepare for increased patch management activities in the coming months.

May 5, 2026

MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Crosshairs

SecurityWeek

Recent vulnerabilities in MetInfo and Weaver E-cology software have been identified, allowing remote attackers to execute arbitrary code without authentication. This means that attackers could potentially take control of systems running these applications through specially crafted requests. The risks are significant as these vulnerabilities expose users to potential data breaches and system compromises. Organizations using these platforms should prioritize addressing these security flaws to protect their systems. The situation underscores the ongoing need for vigilance in software security and timely updates.

May 5, 2026

WhatsApp Discloses File Spoofing, Arbitrary URL Scheme Vulnerabilities

SecurityWeek

WhatsApp recently disclosed two vulnerabilities that could pose risks to its users. The first is a file spoofing issue, which could allow attackers to disguise a malicious file as a legitimate one. The second vulnerability involves an arbitrary URL scheme that could lead to unwanted actions when users click on certain links. These vulnerabilities were reported to Meta through their bug bounty program and have been addressed in updates released earlier this year. Users of WhatsApp should ensure their app is updated to maintain security, as these vulnerabilities could potentially be exploited if left unpatched.

May 5, 2026

Trellix Reveals Unauthorized Access to Source Code

Infosecurity Magazine

Trellix, a security vendor, has reported a breach that resulted in unauthorized access to its source code. The breach raises concerns about the potential for further exploitation of the accessed code, which could lead to vulnerabilities in the company's products or services. While the specifics of what data was accessed remain unclear, such incidents can undermine customer trust and affect the overall security posture of companies relying on Trellix’s solutions. This incident serves as a reminder of the importance of robust security measures and monitoring against unauthorized access. Companies in the cybersecurity sector must remain vigilant to protect sensitive information and maintain their reputations.

May 5, 2026

Can your coding style predict whether your code is vulnerable?

Help Net Security

Researchers at the University of Massachusetts Dartmouth are exploring whether coding styles can indicate vulnerabilities in software. They have found that individual developers leave distinct 'fingerprints' in their code, including naming conventions and loop structures. This study aims to determine if these unique patterns can also signal potential weaknesses in the code. The implications of this research could be significant, as it may lead to new methods for identifying vulnerabilities before they can be exploited. If successful, this could help developers write safer code by understanding the risks associated with certain coding habits.

May 5, 2026

Instructure confirms data breach, ShinyHunters claims responsibility

SCM feed for Latest

Instructure, the company behind the Canvas learning management system, has confirmed a data breach that has exposed personal information of its users. The breach was disclosed on a Friday, and the hacker group ShinyHunters has claimed responsibility for the attack. While Instructure has not provided detailed information about the types of personal data compromised, the incident raises concerns about the security of educational platforms and the sensitive information they handle. Users of Canvas and potentially other Instructure services should remain vigilant and take steps to secure their accounts, as the exposure of personal data can lead to identity theft or further phishing attempts. This incident highlights the ongoing risks that educational institutions face in protecting their digital environments.

May 4, 2026