CVE-2026-107187highCWE-200

CVE-2026-107187: high-severity vulnerability in Eptura Archibus

Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables

Published · Updated

Follow this CVE+ Monitor Archibus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.3%
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected products
Eptura · Archibus
Related CVEs — Eptura Archibus

In the same product, most dangerous first.

CVE-2026-107188CRITICALEptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code ExecutionEPSS 0.4%CVE-2026-107186HIGHEptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session ReuseEPSS 0.4%