A critical unauthenticated remote code execution vulnerability in the Weaver E-cology platform is currently being actively exploited in the wild.

CVE-2026-22679 carries a maximum CVSS score of 9.8 and affects Weaver E-cology 10.0 builds released before 20260312.

The security flaw exists in an exposed debug endpoint that allows attackers to execute arbitrary commands without requiring any authentication.

By sending specially crafted POST requests, attackers can pass malicious input directly to the operating system.

The earliest evidence of exploitation was observed on March 17, 2026, just five days after the vendor patch was released.

The Vega Threat Research team has uncovered a series of attacks that began just days after the vendor released an official patch.

This rapid weaponization highlights how quickly threat actors can adopt new exploits to compromise enterprise platforms.

Weaver E-cology RCE exploited

The attackers began their campaign by verifying their remote code execution capabilities through simple ping callbacks.

Using the Tomcat-bundled Java Virtual Machine, they launched a series of ping commands directed at a callback infrastructure associated with the Goby vulnerability-scanning framework.

This technique allowed the attackers to easily confirm their access by checking the HTTP response body for unique marker tokens.

Following their initial access, the operators aggressively attempted to deliver various malicious payloads over three days.

They tried to drop multiple executable files and a Windows Installer package specifically named to reflect the targeted Weaver software.

Fortunately, robust endpoint detection and response defenses successfully quarantined these attempts, effectively preventing the deployment of the malicious files.

After security tools blocked their initial payloads, the attackers shifted to active evasion.

They copied the legitimate Windows PowerShell executable into a plain-text file to bypass standard process-name detection.

Through this renamed binary, they attempted to fetch and execute fileless PowerShell scripts directly in memory. However, these actions were also successfully intercepted.

Throughout the attack sequence, the threat actors continuously executed system discovery commands like whoami and tasklist.

Because the vulnerable debug endpoint reflects the output of executed commands directly in the HTTP response, the attackers did not need to establish a persistent shell on the victim host.

This strict request-and-response behavior allowed them to effortlessly conduct discovery and payload delivery concurrently.

Organizations running Weaver E-cology must urgently update their systems to build 20260312 or later, which completely removes the vulnerable debug endpoint.

The Vega Threat Research teams should actively monitor for anomalous processes parented by the Java Virtual Machine, particularly those involving network utilities or command-line interpreters.

Implementing robust endpoint defenses and routinely reviewing network traffic to the affected API paths can also help identify potential compromise attempts.

Indicators of Compromise (IOCs)

Network Indicators

IP Address	Purpose	Associated URLs / Activity
152.32.173[.]138	Callback verification (Goby framework)	http://152.32.173[.]138/U<16hex>.<8hex>
205.209.116[.]54	Initial payload hosting	/vsgbt.exe, /hjchhb.exe
161.132.49[.]114	Base64 stager hosting	/config.js
141.11.89[.]42	MSI payload delivery	/fanwei0324.msi
132.243.172[.]2	Fileless PowerShell scripts	/config/xx.ps1, /w-2026/x.ps1

File Hash

File Name	SHA256 Hash
fanwei0324[.]msi	147ac3f24b2b63544d65070007888195a98d30e380f2d480edffb3f07a78377f

Filenames / Artifacts

Filename	Description
vsgbt[.]exe	Initial stager
hjchhb[.]exe	Initial stager
nvm[.]exe	Fake Node Version Manager binary
fanwei0324[.]msi	Malicious MSI installer
2[.]txt	Renamed PowerShell binary
config[.]js	Base64 stager
xx[.]ps1 / x[.]ps1	Fileless PowerShell payloads

Host Indicators

Indicator Type	Description
Suspicious Processes	`java[.]exe` spawning `cmd[.]exe`, `powershell[.]exe`, `ping[.]exe`
Exploitation Sign	Unauthorized command execution via debug endpoint

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Critical Weaver E-cology RCE Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.