SecOraLens
CriticalCVECVE-2026-107186

Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)

Rapid7·Source published ·1 min read

What happened?

Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication ( CVSS: 8.6 High). The most serious functions allow for full database read ( CVSS: 8.5 High) and an insecure file upload ( CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.

Key details

  • A legacy API endpoint can be abused to skip authentication and invoke functions.
  • The getDataRecords workflow permits reading any database table, exposing usernames and passwords.
  • The writeHTMLtoFile workflow accepts attacker-controlled content and file extension, enabling arbitrary file writes.

Affected

  • Archibus versions before 2025.02 are vulnerable.

Fixes and mitigations

  1. Update Archibus to version 2025.02 or later, which moves the vulnerable DWR method to a REST API.

What to look for

  • Multiple DWR calls can be batched using the callCount parameter to bypass auth.

Summarised by SecOraLens from Rapid7. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories