Login Request a demo
High severity · published Oct 19, 2026
CVE-2026-107187
Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
8.5
CVSS
0.3%
EPSS
No
On KEV
Description
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archibus · Eptura
before 2025.02 · source: vendor
Affected product
AR
Archibus
Eptura
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107187
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107187
www.rapid7.com
https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/
More from Archibus
9.6
CVE-2026-107188
Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
8.6
CVE-2026-107186
Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
7.8
CVE-2023-48645
An issue was discovered in the Archibus app 4.0.3 for iOS
7.5
CVE-2025-25652
In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal
6.1
CVE-2023-48644
An issue was discovered in the Archibus app 4.0.3 for iOS