CVE-2026-107186 Details
Description
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
A vulnerability in Eptura Archibus Web Central allows an unauthenticated user to bypass authentication and execute workflow rules via a legacy API endpoint. This is achieved by sending a Direct Web Remoting (DWR) request that includes the 'isPasswordUppercase' method to establish a privileged session, followed by the 'runWorkflowRule' method to execute any chosen workflow rule without authentication. The vulnerability exploits the DWR's capability to process multiple method calls in a single request, taking advantage of a whitelisted method that can set a user's session context.
Users should update Archibus to version 2025.02 or higher, where this vulnerability has been addressed. The vulnerable DWR method was moved to a REST API in version 2025.02. Instructions for downloading the updated version are available on the Eptura website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/ | [email protected] | BundleExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eptura Archibus | < 2025.02 |
CPE
Remediation | |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |