Authentication Bypass Vulnerability in Eptura Archibus
CVE-2026-107186

8.6HIGH

Key Information:

Vendor

Eptura

Status
Archibus
Vendor
CVE Published:
19 October 2026

What is CVE-2026-107186?

An unprivileged user can exploit a flaw in Eptura Archibus, allowing them to execute workflow rules without proper authentication. Specifically, by sending a DWR request with the 'isPasswordUppercase' method followed by a request to run a workflow rule, unauthorized operations can potentially be performed. This vulnerability poses significant security risks, leading to unauthorized access and manipulation of sensitive information.

Affected Version(s)

Archibus 0 < 2025.02

References

https://www.rapid7.com/blog/post/ve-authentication-bypass...
related

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Chang, Security Consultant, Rapid7
.