Eptura Archibus flaws allow auth bypass, database reads, and RCE
Original title: Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)
Rapid7 says a pre-auth DWR call chain reaches database reads and file upload that runs as Local Service.
Rapid7 disclosed three vulnerabilities in Eptura Archibus found during Vector Command red teaming. A legacy Java DWR endpoint can set a privileged session and then run workflow rules without authentication, rated CVSS 8.6. Tested rules include full database read (CVSS 8.5) and an insecure file upload (CVSS 9.6) that leads to remote code execution as NT AUTHORITY/Local Service. The post says the issues are fixed. Only CVE-2026-107186 is named for the authentication bypass.
Unconfirmed: Affected and fixed version numbers are not stated, and in-the-wild exploitation is not mentioned.
- An attacker with HTTP access can read secrets and passwords from the database.
- Code execution is described as NT AUTHORITY/Local Service on the server.
- Eptura said in 2023 that over 16,000 companies used Archibus, including 40% of the Fortune 500.
- Marcus Chang of Rapid7 is credited; disclosure followed Rapid7’s policy.
Impact: Unauthenticated database read and remote code execution
| Product | Affected |
|---|---|
| Eptura Archibus | — |
- 1.Apply Eptura’s fix for the Archibus authentication bypass, database read, and file-upload flaws.
- CVEs
- CVE-2026-107186
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107186 | Unauthenticated workflow-rule execution in Eptura Archibus | 8.6 | — |
From the original article
8 min read at rapid7.comOverview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8. 6 High).
By Marcus Chang · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.