Eptura Archibus: Unrestricted file upload leading to remote code execution
Summary
Eptura Archibus versions below 2025.02 let a user upload export reports with arbitrary contents and a JSPX file extension. Uploaded files can be requested from the web and executed, so an attacker can run system commands on the server as NT AUTHORITY/Local Service. Rapid7 reports that this flaw can be chained with an unauthenticated authentication bypass (CVE-2026-107186), which removes the need for credentials; the CVSS score assumes low privileges.
Affected
- Eptura Archibus (Archibus Web Central) versions below 2025.02
Fixed in
- Update to Archibus 2025.02 or later (installer is available through the Eptura customer account)
- Version 2025.01: conflicting information; Eptura reportedly said a fix was in development on 9 October 2026. Confirm with Eptura.
- Older releases: Unknown. Safeguard.sh reports no patch for 2024.04 and older and a web.xml mitigation, but this is unverified; obtain it from Eptura.
Workaround
- Restrict access to the Archibus web interface with a VPN or IP allowlist until patched
- Restricting access does not replace patching
Exploitation
- No in-the-wild exploitation reported; not yet confirmed against the CISA KEV catalogue
- No public exploit repository found
- Rapid7 published technical details of the chain and demonstrated the upload flaw in an authorised test
- CISA SSVC: exploitation none, not automatable, total technical impact
Our recommendation
- Inventory all Archibus instances and their versions and check for internet exposure
- Put internet-facing instances behind a VPN or IP allowlist now
- Upgrade to 2025.02 or later; confirm the status of 2025.01 and older releases with Eptura
- Search web directories and logs for unexpected .jspx files; if exposure is confirmed, review and rotate database credentials
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Rapid7 blog: Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus www.rapid7.com
- OpenCVE: CVE-2026-107188 app.opencve.io
- Strix: CVE-2026-107188 www.strix.ai
- OffSeq Radar: CVE-2026-107188 radar.offseq.com
- Securhub: Eptura Archibus three flaws www.securhub.pl
- TheLS: CVE-2026-107188 RCE thelaymansecurity.com
- Safeguard.sh: Eptura Archibus auth bypass and RCE safeguard.sh
- HOL Guard: CVE-2026-107188 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:44.
Original description (NVD)
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.