Eptura Archibus EUVD-2026-104461

Exploitation requires the attacker to reach Archibus's export-report upload functionality, which normally needs a user account (PR:L); however, the separately disclosed authentication bypass can be chained to remove this requirement, enabling unauthenticated exploitation. The concrete prerequisites are: the ability to submit an export report with arbitrary file contents (JSP code) and an attacker-controlled file extension (JSPX), and the ability to subsequently browse to the stored file so the server renders/executes it. The limiting factors are that the host must be a Java/JSP-capable Archibus deployment and the upload/serving path must store the file in a web-executable location; no user interaction by a victim is needed. For organizations that have applied the vendor fix, the file-extension and content controls close the path.

This is a genuine high-priority issue, not a CVSS-inflated one. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6) describes a network-reachable, low-complexity file-upload flaw (CWE-434) that yields command execution with a scope change. Critically, Rapid7 documents that it can be chained with a separate authentication bypass, which effectively nullifies the PR:L (low-privilege) requirement and enables unauthenticated remote code execution - the practical worst case. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is driven by the intrinsic ease of exploitation and the researcher-confirmed chain rather than by observed in-the-wild activity. One signal to verify: the base vector lists A:N (no availability impact), which is conservative for a command-execution flaw where an attacker running code as the server could trivially disrupt availability - treat availability impact as realistically higher than the published vector implies. Overall: treat as a real priority for any internet-facing Archibus instance, with patching urgency driven by the unauth RCE chain despite the absence of EPSS/KEV/POC data.

An attacker reaches an internet-facing Eptura Archibus instance, uses the chained authentication bypass to act without valid credentials, then uploads an export report whose contents are JSP code while specifying a .jspx extension. The attacker then simply browses to the uploaded file, causing the server to execute the embedded code and granting command execution on the host. No public POC was provided in the input, but Rapid7's advisory confirms the technique is validated.