Critical severity · published Oct 19, 2026
CVE-2026-107188
Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
9.6
CVSS
0.4%
EPSS
No
On KEV
Description
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archibus · Eptura
before 2025.02 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107188
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107188
www.rapid7.com
https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/
More from Archibus
8.6
CVE-2026-107186
Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
8.5
CVE-2026-107187
Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
7.8
CVE-2023-48645
An issue was discovered in the Archibus app 4.0.3 for iOS
7.5
CVE-2025-25652
In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal
6.1
CVE-2023-48644
An issue was discovered in the Archibus app 4.0.3 for iOS