Eptura Archibus: Authentication bypass in DWR API
Summary
Eptura Archibus Web Central exposes a legacy Direct Web Remoting (DWR) API endpoint that can be abused to run workflow rules without authentication. An unauthenticated attacker with HTTP access to the server can trigger functions that are normally protected. Rapid7 reports that this bypass is part of a chain that also allows database reads and, via an insecure file upload, remote code execution. Versions before 2025.02 are affected.
Affected
- Eptura Archibus (Archibus Web Central) versions before 2025.02
- Status of version 2025.01 and older: unresolved, see Recommendation
Fixed in
- Version 2025.02 or later, according to Rapid7 (the vulnerable DWR method was moved to a REST API)
- Fix for 2025.01: unconfirmed, sources conflict
- Older releases: reportedly no patch; Eptura's mitigation not verified
Workaround
- Restrict access to the DWR endpoint to trusted IP ranges (mitigation, not a fix)
- Keep Archibus off the internet and only reachable via VPN
- Remove or disable unused workflow rules that can be reached via DWR
Exploitation
- No known exploitation in the wild; CISA SSVC assessment: exploitation none, automatable yes
- Rapid7's detailed technical write-up is public; VulDB lists no exploit available
- Treat the chain as reproducible by skilled attackers
Our recommendation
- Inventory all Archibus instances and record exact versions
- Upgrade to 2025.02 or later after testing in a non-production environment
- Until patched, block external access and restrict DWR endpoints
- Patch all three related Rapid7 findings together
- Review logs and web directories for unexpected files; rotate credentials if abuse is suspected
- Ask Eptura to confirm the status of 2025.01 and older versions
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Rapid7: Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED) www.rapid7.com
- OpenCVE: CVE-2026-107186 app.opencve.io
- VulDB: CVE-2026-107186 vuldb.com
- Safeguard: Eptura Archibus CVE-2026-107186 auth bypass safeguard.sh
- Hol.org: CVE-2026-107186 hol.org
- Strix: CVE-2026-107186 www.strix.ai
- The Layman Security: Eptura Archibus RCE thelaymansecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:46.
Original description (NVD)
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.