Archibus Patches Triple Flaw: Auth Bypass, File Upload RCE

Three vulnerabilities in Eptura Archibus, including one rated CVSS 9.6 critical, were disclosed by Rapid7 on October 19, 2026. All three are fixed in Archibus version 2025.02. Rapid7 found them during continuous red-team exercises through its Vector Command service.

CVE-2026-107188 (CVSS 9.6, critical) is an unrestricted file upload in the AbCommonResources-writeHTMLtoFile function. The function accepts user-controlled file content and extensions without validation, letting an attacker write server-side code to a web-accessible path and execute it.

CVE-2026-107186 (CVSS 8.6, high) is an authentication bypass in a legacy Java Direct Web Remoting (DWR) API endpoint. Method-call chaining in a single request lets an attacker obtain a privileged system session without valid credentials.

CVE-2026-107187 (CVSS 8.5, high) allows unauthenticated database queries through the AbCommonResources-getDataRecords workflow. It has no access controls on which tables can be queried, including those holding user credentials.

What to do

Update Archibus to version 2025.02 or later. That release moves the vulnerable DWR method to a REST API, closing the authentication bypass. Eptura customers can access the update through their account portal.

If an immediate update is not possible, restrict network access to the Archibus application tier. All three flaws require network access to the application endpoint; isolation reduces exposure while you schedule the update.

Priority

The three flaws run in sequence from unauthenticated network access to server-side code execution. CVE-2026-107186 bypasses authentication, CVE-2026-107188 writes and executes server-side code, and CVE-2026-107187 reads database contents including credentials. Rapid7’s report includes a proof-of-concept for the chain. Update before you wait for an active exploitation report.

Archibus is deployed in large organizations as a facility and workplace management platform. A typical installation is internal-facing but accessible from most corporate workstations. Unpatched, the blast radius from a single compromised internal host is significant.

Related: Plex2Shell Exploited to Deploy Miners, Linux Backdoor, Critical Ghostscript Flaw Lets PDFs Execute Code, Perforce P4 Search Containers Expose RCE, Auth Bypass