Rapid7 Finds Critical Remote Code Execution Flaw in Eptura Archibus
A legacy API endpoint in Eptura Archibus allows unauthenticated remote code execution and full database reads, affecting thousands of global enterprises.
Key points
- Rapid7 discovered three vulnerabilities in Eptura Archibus, including a critical remote code execution flaw.
- An authentication bypass allows attackers to run workflow rules without credentials via a legacy API.
- The flaw enables full database access and code execution as NT AUTHORITY/Local Service.
Rapid7 security researchers identified three new vulnerabilities in Eptura Archibus, a facility management platform. The most severe flaw allows unauthenticated remote code execution on the server, rated 9.6 Critical on the CVSS scale.
The discovery occurred during continuous red teaming exercises using Rapid7’s Vector Command service. Marcus Chang, a security consultant at Rapid7, found that a legacy API endpoint could be exploited to bypass authentication. This bypass carries a CVSS score of 8.6 High.
Technical Details of the Exploit
The Archibus Web Central application uses Java Direct Web Remoting for API functionality. The isPasswordUppercase method sets a system session in the thread, while the runWorkflowRule method retrieves this session for authentication. Attackers can chain these methods to run workflow rules without providing credentials.
This authentication bypass enables two serious outcomes. First, it allows a full database read, rated 8.5 High, exposing secrets and passwords. Second, it permits an insecure file upload that leads to remote code execution.
Impact on Organizations
Archibus helps organizations manage physical buildings, equipment, and real estate from a central location. According to Eptura, over 16,000 companies and 40% of the Fortune 500 used the software in 2023.
A malicious actor with HTTP network access to the server can read sensitive data from the database. They can also execute system commands as NT AUTHORITY/Local Service, gaining control of the server. This vulnerability was disclosed in accordance with Rapid7's vulnerability disclosure policy.
What should you do?
As Threat Times reported in October 2026 regarding similar authentication bypasses in remote support tools, such flaws can lead to rapid compromise. Organizations using Archibus should verify their exposure immediately.
What to do and how to stay safe: Eptura
- Check if your Archibus instances are accessible from the internet or untrusted networks.
- Monitor logs for unusual API calls to the DWR endpoint, specifically involving isPasswordUppercase.
- Restrict access to the Archibus Web Central application to trusted IP addresses only.
- Contact Eptura support to confirm if a patch is available for CVE-2026-107186 and apply it once provided.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the Archibus remote code execution flaw?
The insecure file upload leading to remote code execution has a CVSS score of 9.6 Critical.
Who discovered these vulnerabilities in Eptura Archibus?
Marcus Chang, a Security Consultant at Rapid7, discovered the vulnerabilities during red teaming exercises.
How many companies use Archibus according to the vendor?
According to Eptura, over 16,000 companies and 40% of the Fortune 500 used Archibus in 2023.
