Eptura Archibus: Database read via DWR workflow rule
Summary
Archibus Web Central, the web application of Eptura Archibus, exposes a DWR (Direct Web Remoting) API that can run workflow rules. An attacker with HTTP access can use a crafted DWR request to read database tables, including the afm_users table with usernames and passwords. The CVSS vector assumes low privileges (PR:L). Unauthenticated database reads depend on chaining this flaw with the authentication bypass CVE-2026-107186.
Affected
- Eptura Archibus versions below 2025.02
Fixed in
- Eptura Archibus 2025.02 or higher (the DWR method used for the authentication bypass was moved to a REST API in 2025.02)
- Reported hotfix for 2025.01 (WebCv2025.01.01.128_Hotfix-for-AD-24576), not yet verified with Eptura
- No patch known for 2024.04 and older
Workaround
- For older releases, Eptura's web.xml mitigation is reported to be available only through Archibus Support; not verified
- Restrict access to Archibus with a VPN or an IP allowlist
- Check whether the DWR interface is reachable from untrusted networks; test any proxy or WAF rule first, as blocking DWR can break Archibus views
- The CVE record provides no workaround
Exploitation
- CISA SSVC: exploitation 'none', automatable 'no'
- Not listed on CISA KEV
- One aggregator reports active exploitation and a public PoC; this could not be confirmed against Rapid7's primary text
- Rapid7 published technical details of the request chain
Our recommendation
- Inventory all Archibus instances and versions
- Update to Archibus 2025.02 or higher; verify any 2025.01 hotfix with Eptura first
- Isolate Archibus from untrusted networks and restrict access via VPN or IP allowlist
- Patch or isolate CVE-2026-107186 and CVE-2026-107188 together with this CVE
- Check logs for unexpected DWR requests and unknown files in web directories
- Rotate passwords of database and application users if exposure is possible
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Rapid7: Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED) www.rapid7.com
- OpenCVE: CVE-2026-107187 app.opencve.io
- Strix: CVE-2026-107187 www.strix.ai
- Safeguard: Eptura Archibus CVE-2026-107186 authentication bypass and RCE safeguard.sh
- Hendry Adrian: Rapid7 details three Eptura Archibus flaws cyber.hendryadrian.com
- The Layman Security: Eptura Archibus CVE-2026-107188 RCE thelaymansecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:24.
Original description (NVD)
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.