Critical Weaver E-cology RCE Vulnerability Actively Exploited in Attacks

A critical unauthenticated RCE (CVE-2026-22679, CVSS 9.8) in Weaver E-cology was actively exploited shortly after a vendor patch; attackers used the exposed debug endpoint to execute commands, verify access via ping callbacks, and attempt to deliver multiple malicious payloads (executables, MSI, and fileless PowerShell). The report includes IOCs (IP addresses, filenames, a SHA256 hash), host indicators (java.exe spawning shell/network utilities), and mitigation advice to update to build 20260312+, monitor JVM-parented processes, and review traffic to the affected API paths.