# Eptura Archibus Authentication Bypass, Database Read and Unrestricted File Upload RCE (CVE-2026-107186, CVE-2026-107187, CVE-2026-107188)

> Rapid7 disclosed three chained vulnerabilities in Eptura Archibus: an authentication bypass in the legacy DWR API (CVE-2026-107186), an arbitrary database table read exposing credentials in afm_users (CVE-2026-107187), and an unrestricted file upload allowing JSPX webshell RCE (CVE-2026-107188). The chain gives unauthenticated code execution and is fixed in Archibus 2025.02 or later.

- **Published:** 2026-10-19T17:15:11Z
- **Last reviewed:** 2026-10-19T17:15:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3904
- **ID:** TL-2026-3904
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-107186, CVE-2026-107187, CVE-2026-107188

## Description

Rapid7 researcher Marcus Chang found three vulnerabilities in Eptura Archibus during Rapid7 Vector Command red teaming, discovered on 2026-05-25 while testing a customer server. The advisory was published on 2026-10-19 after coordinated disclosure with the vendor. The source does not state in-the-wild exploitation by a threat actor. Versions prior to 2025.02 are affected, and the vendor fixed the issue by moving the vulnerable DWR method to a REST API in 2025.02.

CVE-2026-107186 (CVSS 8.6) is an authentication bypass in the Java Direct Web Remoting (DWR) endpoint /archibus/dwr/call/plaincall/. SecurityServiceImpl.isPasswordUppercase() is whitelisted for pre-authentication access and sets the core system user session on the thread-local ContextStore. When several DWR calls are batched in one request (callCount=2), the privileged session persists into later calls such as DWRWorkflowService.runWorkflowRule(). An attacker therefore runs isPasswordUppercase first and then invokes an arbitrary workflow rule with attacker-chosen parameters. The attacker needs a scriptSessionId (obtainable via __System.generateId) and the PROJECT_ID (obtainable via SecurityService.getProjects).

CVE-2026-107187 (CVSS 8.5) is an arbitrary database read in the workflow rule AbCommonResources-getDataRecords. ViewHandlers.getDataRecords() passes the attacker-controlled restriction parameter into dataSource.formatSqlQuery() without sanitization. Chained with the bypass, an attacker can read any table, for example afm_users (user_name, user_pwd, email, role_name), using tableName=afm_users, fieldNames and restriction=1=1.

CVE-2026-107188 (CVSS 9.6) is an unrestricted file upload in the workflow rule AbCommonResources-writeHTMLtoFile. ViewHandlers.writeHTMLtoFile() writes the attacker-supplied html parameter to File.createTempFile("DataViewReport", "." + fileExtension, outputDir) with a user-controlled extension. Files land at /archibus/schema/per-site/exportReports/DataViewReport[TIMESTAMP].[extension]. Uploading a .jspx webshell works because JSPX files bypass the authentication redirects, giving unauthenticated code execution as NT AUTHORITY\Local Service.

Disclosure timeline: vendor notified 2026-07-02, full disclosure document provided 2026-08-11, final follow-up 2026-09-29, vendor requested a one-week extension on 2026-10-09 (granted), public disclosure 2026-10-19. Rapid7 Exposure Management and Vulnerability Management customers get vulnerability checks in the 2026-10-21 content release. The source lists no network IOCs; the IOCs below are request, path and artifact indicators derived from the technical analysis.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1212 Exploitation for Credential Access
- T1005 Data from Local System

## Sources

- [Rapid7: Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)](https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed)
- [Eptura Archibus Revision History for V.2025.02](https://knowledge.eptura.com/Archibus/Whats_New_for_Archibus/Revision_History_Overview/Revision_History_for_Archibus_V.2025.02)
- [Rapid7 Vulnerability Disclosure Policy](https://www.rapid7.com/security/disclosure/)
- [NVD CVE-2026-107188](https://nvd.nist.gov/vuln/detail/CVE-2026-107188)
- [NVD CVE-2026-107186](https://nvd.nist.gov/vuln/detail/CVE-2026-107186)
- [NVD CVE-2026-107187](https://nvd.nist.gov/vuln/detail/CVE-2026-107187)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3904