Eptura Archibus: Three Flaws Let Attackers Take Over Servers Without Logging In

Attackers can chain three vulnerabilities in Eptura Archibus to read the database and run code on the server, all without logging in. Rapid7 published the details on October 19. Upgrading to version 2025.02 or later is recommended.

What the researchers found

Organizations use Archibus to manage buildings, equipment and real estate. The researchers found a flaw in an older application interface that let callers run functions without proper authentication.

CVE-2026-107186 is an authentication bypass, CVE-2026-107187 allows data to be read from the database, and CVE-2026-107188 involves unsafe file uploads. Chained together, they let an attacker run commands on the server. Access to the credentials stored in the database is especially serious.

Rapid7 found the issues during authorized testing. A write-up of that kind of test does not mean criminals have exploited the flaws.

Who is at risk

Any Archibus installation older than 2025.02 should be checked. Network exposure also matters: restricting access cuts down the number of potential attackers, but it does not replace patching.

In many organizations, the people who maintain the application are not the ones responsible for infrastructure security. Identify who owns each installation and confirm which version it actually runs before you close the ticket.

What to do now

• Inventory your Archibus servers and check which releases are installed.
• Schedule an upgrade to version 2025.02 or later, following Eptura’s instructions.
• Until you upgrade, restrict network access to only the users and systems that need it.
• Review the application logs and look for unusual files on the server.
• If you find signs of abuse, preserve the evidence for analysis and decide whether credentials need to be changed.

SecurHUB’s take

Property management systems need regular application security assessments too. Penetration testing shows whether several features that look unrelated can be combined to open a path to your data and your server.

Sources: Rapid7, Threadlinqs