Security disclosures affecting Eptura products, primarily Archibus, the enterprise facility and workplace management platform deployed in large organizations. Covers authentication flaws, code execution vulnerabilities, and patch guidance. Combined article + CVE feed for the Eptura beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-10-20-eptura-archibus-triple-cve-auth-bypass-rce/https://0daynews.com/articles/2026-10-20-eptura-archibus-triple-cve-auth-bypass-rce/Rapid7 disclosed three Archibus vulnerabilities including a CVSS 9.6 unrestricted file upload. All three are patched in Archibus 2025.02.Tue, 20 Oct 2026 12:00:00 GMTEpturaarticlehttps://0daynews.com/cve/cve-2026-107186/https://0daynews.com/cve/cve-2026-107186/Legacy DWR API endpoint in Archibus before 2025.02 allows unauthenticated method-call chaining to obtain a privileged system session. No credentials required.Tue, 20 Oct 2026 00:00:00 GMTEpturahighcvehttps://0daynews.com/cve/cve-2026-107187/https://0daynews.com/cve/cve-2026-107187/Archibus before 2025.02 allows unauthenticated database table queries via the getDataRecords workflow, exposing user credentials and other sensitive data.Tue, 20 Oct 2026 00:00:00 GMTEpturahighcvehttps://0daynews.com/cve/cve-2026-107188/https://0daynews.com/cve/cve-2026-107188/Archibus before 2025.02 accepts user-controlled file content and extensions in writeHTMLtoFile without validation, letting an attacker write and execute server-side code.Tue, 20 Oct 2026 00:00:00 GMTEpturacriticalcve