Vendor

Eptura

Security disclosures affecting Eptura products, primarily Archibus, the enterprise facility and workplace management platform deployed in large organizations. Covers authentication flaws, code execution vulnerabilities, and patch guidance.

3 CVEs1 articlesRSS JSON

CVEs

CVE-2026-107186

[ HIGH ]CVSS 8.6patched

Eptura Archibus DWR endpoint authentication bypass

Legacy DWR API endpoint in Archibus before 2025.02 allows unauthenticated method-call chaining to obtain a privileged system session. No credentials required.

Eptura / Archibus (versions before 2025.02)Oct 20

CVE-2026-107187

[ HIGH ]CVSS 8.5patched

Eptura Archibus unrestricted database read via getDataRecords

Archibus before 2025.02 allows unauthenticated database table queries via the getDataRecords workflow, exposing user credentials and other sensitive data.

Eptura / Archibus (versions before 2025.02)Oct 20

CVE-2026-107188

[ CRITICAL ]CVSS 9.6patched

Eptura Archibus unrestricted file upload enabling server-side code execution

Archibus before 2025.02 accepts user-controlled file content and extensions in writeHTMLtoFile without validation, letting an attacker write and execute server-side code.

Eptura / Archibus (versions before 2025.02)Oct 20

Articles

~/articles/2026-10-20-eptura-archibus-triple-cve-auth-bypass-rce

eptura

Archibus Patches Triple Flaw: Auth Bypass, File Upload RCE

Rapid7 disclosed three Archibus vulnerabilities including a CVSS 9.6 unrestricted file upload. All three are patched in Archibus 2025.02.

Oct 20read →