Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
CVSS score
8.6
EPSS probability
—
Risk score
0.9
Published
13 h ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchibus helps organizations administer and manage their physical buildings, equipment, and real estate fr
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-107186"