Key points
- A legacy API endpoint allows authentication bypass with a CVSS score of 8.6.
- An insecure file upload flaw rated 9.6 enables remote code execution.
- Attackers can read database secrets and run system commands as Local Service.
Attackers with network access to Eptura Archibus servers can now execute system commands and read sensitive database contents without providing any credentials. This capability stems from three newly disclosed vulnerabilities found by Rapid7 security researchers during continuous red teaming exercises. The most severe issue allows for full remote code execution, granting attackers control over the server environment.
In plain English
The flaws exist in the Archibus Web Central application, which uses Java Direct Web Remoting for API functions. A legacy endpoint permits users to bypass authentication checks entirely. Once inside, attackers can trigger specific workflow rules that were previously protected. These rules include functions for reading database records and uploading files. The file upload mechanism is insecure, leading directly to the execution of arbitrary code on the server.
The background
Rapid7 security consultant Marcus Chang discovered these issues while testing Eptura Archibus through the Vector Command service. The product helps organisations manage physical buildings, equipment and real estate assets. According to Eptura, more than 16,000 companies used Archibus in 2023. The vulnerabilities allow a malicious actor to read secrets and passwords from the database. They can also execute system commands as the ‘NT AUTHORITY/Local Service’ account, effectively gaining full server control.
What changes now
The vulnerabilities have been fixed, according to the Rapid7 disclosure. The authentication bypass is assigned CVE-2026-107186 and rated High. The database read function is rated High. The insecure file upload leading to remote code execution is rated Critical. As RedTeam Log reported on 2026-10-20, similar upload bugs in Archibus versions before the 2025.02 patch previously permitted server command execution. Users should ensure their systems are updated to mitigate these risks.
The attacker's path
Teams usually face threats where legacy API endpoints lack proper session validation. Check whether your infrastructure exposes older interfaces that might bypass modern authentication layers. Attackers often chain these initial access flaws with insecure file handling to achieve code execution. Monitor for unusual workflow rule executions that do not originate from authenticated users. Ensure that file upload mechanisms strictly validate content types and storage permissions to prevent arbitrary code runs.
Background: File upload vulnerabilities
Monitor for unexpected MIME types, rapid sequential uploads, and execution attempts from storage directories. Combine server-side validation with strict content-type checking. Review file naming patterns for double extensions. Use automated scanning to find misconfigurations that allow script execution in upload folders.
Read the full guide: Detect File Upload Vulnerabilities: Log Signals and Blind Spots
What to do and how to stay safe: Eptura Archibus
- Verify that all Eptura Archibus instances are updated to the latest patched version.
- Review network access controls to limit HTTP traffic to the Archibus server.
- Monitor server logs for unauthenticated attempts to access legacy API endpoints.
- Check database access patterns for unusual queries that might indicate data exfiltration.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of the remote code execution flaw?
The insecure file upload leading to remote code execution is rated Critical with a CVSS score of 9.6.
Who discovered these vulnerabilities in Eptura Archibus?
Marcus Chang, a Security Consultant at Rapid7, discovered the flaws during red teaming exercises.
Can attackers access database information without logging in?
Yes, the authentication bypass allows attackers to read secrets and passwords from the database without credentials.
