Archibus Critical Flaw Allows Unauthenticated Remote Code Execution
A severe vulnerability in Eptura Archibus permits attackers to upload executable files and run commands on servers without logging in.
Key points
- The flaw affects Eptura Archibus versions prior to 2025.02.
- Attackers can chain an authentication bypass with file upload issues.
- The National Vulnerability Database rates the severity as critical.
Eptura Archibus versions released before 2025.02 contain a critical security flaw that allows remote attackers to execute arbitrary code on affected servers. The National Vulnerability Database assigned the identifier CVE-2026-107188 to this issue and gave it a CVSS score of 9.6. This high score reflects the ease with which an attacker can compromise the system. No patch or update has been confirmed by the vendor as of this report.
How it unfolded
- The vulnerability stems from a lack of proper validation during the report export process.
- Users can upload files with arbitrary contents, including JavaServer Pages.
- Attackers specify the JSPX extension to ensure the server treats the file as code.
- An existing authentication bypass allows unauthorized users to trigger this upload mechanism.
Who is affected
Organizations running Eptura Archibus before the 2025.02 release are directly exposed to this threat. The flaw allows any individual who can reach the application to upload malicious scripts. Because the authentication bypass vulnerability can be chained with the file upload issue, attackers do not need valid credentials to run code. This combination effectively grants full control over the underlying server environment to anyone on the internet.
Our take on the response
The ability to chain an authentication bypass with a file upload flaw creates a dangerous attack path. Attackers do not need to steal passwords or exploit complex logic to gain access. This suggests that the application’s trust model for uploaded content is fundamentally broken in older versions. Until the vendor provides a secure update, the risk remains unmitigated for all pre-2025.02 installations.
Who needs to act first
Managed service providers should immediately inventory all client environments running Eptura Archibus. Teams usually prioritize systems exposed to the public internet for immediate isolation or monitoring. Check whether the application is accessible without network segmentation. Back up current configurations and data before attempting any manual mitigations. Test any temporary restrictions in a non-production environment first to avoid service disruption.
What to do and how to stay safe: Eptura Archibus
- Verify the installed version of Eptura Archibus against the affected list.
- Restrict network access to the application to trusted IP addresses only.
- Monitor server logs for unusual file uploads or execution attempts.
- Wait for the vendor to release a confirmed security update before applying fixes.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Eptura Archibus are affected by CVE-2026-107188?
The vulnerability affects all versions of Eptura Archibus released before 2025.02.
Is there a patch available for this critical vulnerability?
No fix has been confirmed yet by the vendor or in the source material.
How do attackers exploit this flaw without credentials?
They chain an authentication bypass vulnerability with the file upload flaw to execute code.
