Eptura Archibus CVE-2026-107187

Exploitation requires network access to an Archibus instance that exposes the DWR (Direct Web Remoting) interface, and the attacker must send a DWR request specifying a particular workflow rule to trigger disclosure of database details (usernames and passwords). Per the base CVSS vector the standalone flaw needs low-privilege authentication (PR:L), but the practical limiting factor is removed when it is chained with the companion authentication-bypass vulnerability, enabling unauthenticated database reads. Limiting/mitigating factors: reachability of the DWR endpoint (network segmentation or not exposing Archibus externally reduces exposure), and database write/delete escalation is unconfirmed (untested). Applying the vendor fix referenced by Rapid7 closes the condition.

This is a genuine priority within affected environments, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) indicates a low-complexity, network-reachable attack that in isolation requires only low-privilege authentication (PR:L) and no user interaction, with a scope change (S:C) reflecting that the flaw lets an in-application actor reach the backing database. The most important signal, however, is the chaining noted in the description: the information-disclosure flaw can be combined with a separate authentication-bypass vulnerability in the same Archibus product, which effectively removes the PR:L requirement and enables fully unauthenticated database reads - raising real-world severity above what the standalone 8.5 score suggests. Disclosed credentials (database usernames and passwords) further amplify impact by enabling follow-on lateral movement. Conflicting/missing signals must be stated explicitly: no EPSS score, no CISA KEV listing, and no confirmed public exploit were provided, so there is currently no evidence of active or at-scale exploitation; the risk is driven by exploit mechanics and credential exposure rather than observed in-the-wild activity. The base vector's PR:L conflicts with the practical unauthenticated outcome once chained - verify against the Rapid7 advisory which path applies to a given deployment. Integrity/availability impact (write/delete) is described as untested, so I:L/A:N should be treated as a lower-bound, not a confirmed ceiling.

A remote attacker sends a crafted DWR (Direct Web Remoting) request referencing a specific workflow rule to an internet- or network-reachable Archibus instance, retrieving database connection details including usernames and passwords. By first exploiting the companion authentication-bypass flaw, the attacker performs this read with no valid credentials, then reuses the harvested database credentials for deeper access. No public exploit was identified at time of analysis, though the technique is described in detail by the reporting vendor (Rapid7).