Eptura Archibus flaws allow auth bypass, database reads, and RCE
Rapid7 says a pre-auth DWR call chain reaches database reads and file upload that runs as Local Service.
64
CVE-2026-107186
Unauthenticated workflow-rule execution in Eptura Archibus
- CVSS 3.1
- 8.6 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Eptura Archibus accepts an unauthenticated DWR request that uses isPasswordUppercase as one call and sets the next call to run a workflow rule. Anyone who can reach the service over the network can trigger those rules with no login and no user interaction. The impact is disclosure of confidential data. Affected builds and the fixed release are not stated.
What to do: Apply Eptura's update for CVE-2026-107186. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Eptura Archibus | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
- Weakness
- CWE-287
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N