Metinfo Vulnerability – Ecology Attacks by Hackers

Cyberattackers Target Enterprise Content Management System and Office Automation Solution

In recent days, threat actors have been exploiting two critical vulnerabilities in MetInfo and Weaver E-cology, two separate enterprise software solutions used by thousands of organizations worldwide.

Vulnerabilities Exploited:

• MetInfo – CVE-2026-29014: Unauthenticated PHP code injection flaw allowing remote code execution (RCE)
• Weaver E-cology – CVE-2026-22679: Exposed debug functionality enabling arbitrary command execution

The exploited vulnerabilities boast high CVSS scores, with CVE-2026-29014 holding a score of 9.8 and CVE-2026-22679 holding a score of 9.3, indicating their severe potential impact. Attackers are able to execute arbitrary code remotely without requiring authentication, highlighting the importance of prompt patching and vigilance against emerging threats.

The widespread adoption of these software solutions poses significant risks for affected organizations, emphasizing the importance of robust security measures and timely updates. As ongoing exploitation attempts are detected across multiple regions, including Asia and beyond, it is crucial for IT teams and administrators to act swiftly in addressing these vulnerabilities to prevent potential breaches and minimize the risk of data compromise.

About Author

Vaibhav

See author's posts