Threat reportVulnerabilityTL-2026-3904
Eptura Archibus Authentication Bypass, Database Read and Unrestricted File Upload RCE (CVE-2026-107186, CVE-2026-107187, CVE-2026-107188)
Eptura Archibus Authentication Bypass, Database Read and (TL-2026-3904) is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-10-19. It has no confirmed attribution, affects Eptura Archibus, references 3 CVEs (CVE-2026-107186, CVE-2026-107187, CVE-2026-107188), maps to 5 MITRE ATT&CK techniques (T1005, T1059, T1190), and is covered by 9 detection rules and 4 indicators of compromise.
- CVSS
- 9.6/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 4Indicators of compromise
Key facts for TL-2026-3904
- Threat ID
- TL-2026-3904
- Severity
- CRITICAL
- CVSS
- 9.6
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- real estate, facilities management, government administration, education, health, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 4
Malware and tooling in Eptura Archibus Authentication Bypass, Database Read and
Malware and tooling: Rapid7
How Eptura Archibus Authentication Bypass, Database Read and works
Rapid7 disclosed three chained vulnerabilities in Eptura Archibus: an authentication bypass in the legacy DWR API (CVE-2026-107186), an arbitrary database table read exposing credentials in afm_users (CVE-2026-107187), and an unrestricted file upload allowing JSPX webshell RCE (CVE-2026-107188). The chain gives unauthenticated code execution and is fixed in Archibus 2025.02 or later.
Rapid7 researcher Marcus Chang found three vulnerabilities in Eptura Archibus during Rapid7 Vector Command red teaming, discovered on 2026-05-25 while testing a customer server. The advisory was published on 2026-10-19 after coordinated disclosure with the vendor. The source does not state in-the-wild exploitation by a threat actor. Versions prior to 2025.02 are affected, and the vendor fixed the issue by moving the vulnerable DWR method to a REST API in 2025.02.
CVE-2026-107186 (CVSS 8.6) is an authentication bypass in the Java Direct Web Remoting (DWR) endpoint /archibus/dwr/call/plaincall/. SecurityServiceImpl.isPasswordUppercase() is whitelisted for pre-authentication access and sets the core system user session on the thread-local ContextStore. When several DWR calls are batched in one request (callCount=2), the privileged session persists into later calls such as DWRWorkflowService.runWorkflowRule(). An attacker therefore runs isPasswordUppercase first and then invokes an arbitrary workflow rule with attacker-chosen parameters. The attacker needs a scriptSessionId (obtainable via __System.generateId) and the PROJECT_ID (obtainable via SecurityService.getProjects).
CVE-2026-107187 (CVSS 8.5) is an arbitrary database read in the workflow rule AbCommonResources-getDataRecords. ViewHandlers.getDataRecords() passes the attacker-controlled restriction parameter into dataSource.formatSqlQuery() without sanitization. Chained with the bypass, an attacker can read any table, for example afm_users (user_name, user_pwd, email, role_name), using tableName=afm_users, fieldNames and restriction=1=1.
CVE-2026-107188 (CVSS 9.6) is an unrestricted file upload in the workflow rule AbCommonResources-writeHTMLtoFile. ViewHandlers.writeHTMLtoFile() writes the attacker-supplied html parameter to File.createTempFile("DataViewReport", "." + fileExtension, outputDir) with a user-controlled extension. Files land at /archibus/schema/per-site/exportReports/DataViewReport[TIMESTAMP].[extension]. Uploading a .jspx webshell works because JSPX files bypass the authentication redirects, giving unauthenticated code execution as NT AUTHORITY\Local Service.
Disclosure timeline: vendor notified 2026-07-02, full disclosure document provided 2026-08-11, final follow-up 2026-09-29, vendor requested a one-week extension on 2026-10-09 (granted), public disclosure 2026-10-19. Rapid7 Exposure Management and Vulnerability Management customers get vulnerability checks in the 2026-10-21 content release. The source lists no network IOCs; the IOCs below are request, path and artifact indicators derived from the technical analysis.
MITRE ATT&CK techniques used in TL-2026-3904
Collection
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access
Persistence
Affected products and versions in Eptura Archibus Authentication Bypass, Database Read and
- Eptura — Archibus
Vulnerable versions: All versions prior to 2025.02
Fixed in: 2025.02 and later
Remediation for Eptura Archibus Authentication Bypass, Database Read and
Patches
- Archibus 2025.02 or higher (vulnerable DWR method moved to a REST API)
Immediate actions
- Upgrade Eptura Archibus to version 2025.02 or later
- Hunt web server and application logs for POST requests to /archibus/dwr/call/plaincall/ containing callCount=2 with SecurityService.isPasswordUppercase followed by workflow.runWorkflowRule
- Inspect /archibus/schema/per-site/exportReports/ for DataViewReport* files with .jspx, .jsp or other executable extensions and remove any found
- Rotate credentials stored in afm_users if exposure is suspected and review the Archibus service account (NT AUTHORITY\Local Service) for unexpected activity
Workarounds
- Block or restrict access to /archibus/dwr/ from untrusted networks until patched
- Deny execution of JSPX/JSP files in /archibus/schema/per-site/exportReports/
Longer-term hardening
- Restrict Internet exposure of Archibus web application servers behind VPN or reverse proxy with authentication
- Deploy web application firewall rules for the legacy DWR endpoint and for requests invoking AbCommonResources-writeHTMLtoFile and AbCommonResources-getDataRecords
- Monitor the exportReports directory with file integrity monitoring and block script execution from it
CVEs associated with Eptura Archibus Authentication Bypass, Database Read and
Weaknesses (CWE) in Eptura Archibus Authentication Bypass, Database Read and
Timeline of Eptura Archibus Authentication Bypass, Database Read and
- Rapid7 Vector Command red teaming discovers the Archibus vulnerabilities while testing a customer server
- Rapid7 initially notifies Eptura of the vulnerabilities
- Rapid7 provides the vendor with the full disclosure document
- Rapid7 sends final follow-up before the public disclosure deadline
- Eptura requests a one-week extension; Rapid7 agrees
- Rapid7 publishes technical analysis of CVE-2026-107186, CVE-2026-107187 and CVE-2026-107188; fix available in Archibus 2025.02 or later
- Rapid7 vulnerability checks for Exposure Management and Vulnerability Management scheduled for the October 21 content release
Sources cited for Eptura Archibus Authentication Bypass, Database Read and
Detection coverage for TL-2026-3904
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3904 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.