Key points
- Three vulnerabilities in Eptura Archibus allow authentication bypass, database reads, and remote code execution.
- The most severe flaw has a CVSS score of 9.6 and enables code execution as NT AUTHORITY/Local Service.
- Rapid7 discovered the issues during red teaming exercises using Vector Command.
Eptura has released fixes for three vulnerabilities in its Archibus facility management software, according to Rapid7. The flaws affect the Web Central web application and include a critical remote code execution issue. A legacy API endpoint allows attackers to bypass authentication entirely. This enables them to read sensitive data from the database and execute system commands on the server without providing any credentials.
In plain English
Attackers with network access to an Archibus server can exploit these flaws via HTTP requests. They can read secrets and passwords stored in the database tables. More critically, they can upload files insecurely to run arbitrary code on the system. This code executes under the NT AUTHORITY/Local Service account, giving the attacker significant control over the server. No authentication is required to trigger these actions.
The background
Rapid7 security consultant Marcus Chang discovered these issues during continuous red teaming exercises through the company’s Vector Command service. The authentication bypass works by chaining two Java Direct Web Remoting methods. One method sets a system session, while the other uses that session to run workflow rules. This allows attackers to execute any workflow, such as reading database records or uploading files, without logging in.
What changes now
Eptura has addressed these vulnerabilities in updated versions of Archibus. The authentication bypass is tracked as CVE-2026-107186. The full database read capability carries a CVSS score of 8.5. The insecure file upload leading to remote code execution is rated at 9.6, which is classified as critical. Organizations using Archibus should verify their current version and apply the available patches immediately to close these attack paths.
Who needs to act first
Teams usually prioritize systems exposed to the internet or untrusted networks when addressing remote code execution flaws. Check whether your Archibus instances are accessible from external networks before applying updates. Back up configuration files and databases before rolling out patches to ensure recovery options exist. Test the update in a non-production environment first to verify that critical facility management functions remain stable after the change.
Background: Authentication bypass vulnerabilities
Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.
Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
What to do and how to stay safe: Eptura
- Verify if your organization runs Eptura Archibus and check the current version against the vendor’s advisory.
- Restrict network access to the Archibus Web Central application to trusted internal IPs if exposure is high.
- Monitor server logs for unusual file upload activity or unauthorized workflow rule executions.
- Ensure you have recent backups of the Archibus database and application configuration before applying updates.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific vulnerabilities were found in Eptura Archibus?
Rapid7 discovered an authentication bypass, a full database read flaw, and an insecure file upload leading to remote code execution.
How severe is the remote code execution flaw?
The insecure file upload vulnerability has a CVSS score of 9.6, which is rated as critical severity.
Who discovered these vulnerabilities?
Marcus Chang, a Security Consultant at Rapid7, discovered the flaws during red teaming exercises.
