Eptura Archibus (building and real-estate management): Rapid7 discloses three flaws, a pre-authentication bypass in a legacy DWR API (CVE-2026-107186, CVSS 8.6), full database read (CVE-2026-107187, 8.5) and a file upload leading to code execution (CVE-2026-107188, 9.6), and says to update to Archibus 2025.02 or later
Rapid7 disclosed three vulnerabilities in Eptura Archibus on 19 October 2026, found by Rapid7 security consultant Marcus Chang during continuous red-teaming through its Vector Command service. Rapid7 says a legacy API endpoint in the Archibus Web Central application, which uses Java Direct Web Remoting (DWR), can be abused to bypass authentication and run workflow functions without logging in (CVE-2026-107186, CVSS 8.6 High); the most serious of those functions allow full database read, including user names and passwords (CVE-2026-107187, CVSS 8.5 High), and an insecure file upload that leads to remote code execution (CVE-2026-107188, CVSS 9.6 Critical). Rapid7 says a malicious actor with HTTP network access to the server can read secrets and passwords out of the database and run system commands as NT AUTHORITY\Local Service. Rapid7 says users should update Archibus to version 2025.02 or higher, in which the vulnerable DWR method used for the bypass was moved to a REST API, with the installer available through an Eptura account. Rapid7's disclosure timeline says it first contacted Eptura on 2 July, that Eptura replied on 9 October clarifying impacted versions and saying a fix was in development for version 2025.01, and that disclosure was moved to 19 October at Eptura's request. Rapid7's post does not include an Eptura statement and does not list exact affected versions. No exploitation outside Rapid7's authorised testing has been reported. Source: Rapid7 blog (19 Oct 2026).
- Product
- Eptura Archibus (Archibus Web Central, facilities, asset and real-estate management)
- Versions
- Rapid7: update to Archibus 2025.02 or later (bypass method moved to a REST API in 2025.02); exact affected range not published by Rapid7
- CVSS
- 9.6 (CVE-2026-107188), 8.6 (CVE-2026-107186), 8.5 (CVE-2026-107187), per Rapid7
- Exploited in Australia?
- unknown
- Patch to
- Upgrade Archibus to 2025.02 or later (Rapid7's guidance; installer via your Eptura account) and confirm the fixed version with Eptura support. Until then, keep Archibus Web Central off the internet or behind VPN/SSO, block unauthenticated requests to /archibus/dwr/ paths at the proxy or WAF, rotate Archibus user passwords and any secrets stored in its database if it was exposed, and look for unexpected files written by the application.
Primary: Rapid7 — Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED) (19 Oct 2026) · CVE: CVE-2026-107186, CVE-2026-107187, CVE-2026-107188