Eptura Archibus CVE-2026-107186

Requires network reachability to the Archibus application's DWR (Direct Web Remoting) interface, which must be exposed and must accept the chained call sequence (isPasswordUppercase followed by a run-workflow-rule call). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity, so no special non-default configuration is implied by the available data - exploitation targets the DWR endpoint of an Archibus deployment reachable by the attacker. The primary limiting factor is network exposure of the DWR endpoint (e.g., Archibus instances restricted to internal networks or behind access controls reduce reachability); no credential or victim-interaction barrier applies.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) describes a network-reachable, low-complexity, unauthenticated authentication bypass with a changed scope - meaning a remote attacker with no credentials and no user interaction can invoke privileged workflow functionality. The CWE-287 (Improper Authentication) classification and the 'Authentication Bypass' tag corroborate the description's mechanism: chaining a DWR call to isPasswordUppercase with a subsequent run-workflow-rule call to execute workflow rules without authenticating. The vendor/research signals are strong: this was reported by Rapid7, a credible research firm, and the blog title frames it as a chain leading to Remote Code Execution and Database Read, which suggests the real-world impact exceeds the C:H/I:N/A:N base metrics (the official vector records only confidentiality impact despite the ability to RUN workflow rules, which normally implies integrity impact - see assessed vector below). No EPSS score, CISA KEV listing, or PoC-availability flag was supplied in the input, so exploitation-probability and active-exploitation signals are UNKNOWN rather than confirmed. CONFLICT TO NOTE: the base vector's I:N sits uneasily with a 'run workflow rules without authentication' capability that should alter state - verify integrity scope with the vendor/Rapid7 advisory. Overall, the unauthenticated + network + low-complexity profile plus a reputable disclosure makes this worth prioritizing for any organization running Archibus, even absent EPSS/KEV data.

A remote attacker with no credentials reaches an internet- or intranet-exposed Archibus DWR endpoint and sends a single crafted DWR request that pairs an isPasswordUppercase call with a run-workflow-rule call, causing the server to execute the workflow rule as though the request were authenticated. Per the Rapid7 disclosure framing, this auth bypass is the entry point of a chain reaching remote code execution and database read. No public exploit availability was indicated in the provided data, though the vulnerability was disclosed by Rapid7 and the attack is low-complexity.