Rapid7 Details Three Eptura Archibus Flaws Enabling Authentication Bypass, Database Reads and RCE
Summary
Rapid7 disclosed three Eptura Archibus flaws: a DWR authentication bypass, database read access and an unrestricted upload that can enable remote code execution. Archibus 2025.02 or later is recommended.
Key points
- Rapid7 reported three vulnerabilities in Archibus Web Central, with CVSS scores of 8.6, 8.5 and 9.6: CVE-2026-107186, CVE-2026-107187 and CVE-2026-107188.
- The authentication bypass abuses sequential calls to the DWR API to run workflow rules without credentials.
- The database-read flaw can expose Archibus-managed tables, including usernames and passwords in the afm_users table.
- The unrestricted file-upload flaw allows user-controlled content and file extensions to be written to disk; chained with the bypass, it can enable JSPX code execution.
- Rapid7 says it demonstrated the upload flaw on a Vector Command customer's server by uploading JSPX code that printed the server time.
- An attacker with HTTP network access could read database secrets and passwords or execute system commands as NT AUTHORITY/Local Service.
- Rapid7 recommends updating Archibus to version 2025.02 or later. It said vulnerability checks for its products were expected in the October 21 content release.
Article Details
- Vulnerability Types
- Authentication bypass
- Unauthorized database read
- Unrestricted file upload leading to remote code execution
- Severity
- High to Critical (CVSS 8.5–9.6; authentication bypass 8.6, database read 8.5, and file upload 9.6)
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe vulnerabilities were exploited through Archibus Web Central's HTTP-accessible application endpoints.T1213 · Data from Information RepositoriesThe getDataRecords workflow was used to read Archibus database records, including usernames and passwords from the afm_users table.T1505.003 · Web ShellThe unrestricted upload allowed attacker-provided JSPX code to be placed at a browsable location and executed when requested.