A crafted web request can take over a server running Eptura Archibus, the facilities management platform organizations use to track buildings, equipment, leases and desk bookings, according to research published by Rapid7. Security consultant Marcus Chang found three flaws that chain together: skip the login, read the whole database including usernames and passwords, and write a file the server will run as code.
The reach is wide. Eptura has said that in 2023 more than 16,000 companies and 40% of the Fortune 500 used Archibus. Rapid7 found the bugs on May 25 during continuous red teaming for a customer of its Vector Command service, and exploited them on that customer's Archibus server.
A pre-login check that hands out a system session
Archibus Web Central uses Java Direct Web Remoting (DWR), an API layer that lets one HTTP request carry several method calls, processed one after another on the same thread. Rapid7 found that one method allowed before login, isPasswordUppercase, loads the core system user session onto that thread. A second call in the same request, runWorkflowRule, then picks up that session and treats the caller as authenticated. The result, tracked as CVE-2026-107186 (CVSS 8.6), is that an unauthenticated attacker can run seemingly any workflow rule.
Two of those workflow rules are where the damage happens, listed here by severity:
- CVE-2026-107188 (CVSS 9.6, Critical): the writeHTMLtoFile workflow writes attacker-supplied content to disk with an attacker-chosen file extension and no validation. Rapid7 wrote a JSPX file into a browsable folder and found that, unlike a JSP file, it ran without forcing a login redirect. That is remote code execution, with system commands running as NT AUTHORITY/Local Service.
- CVE-2026-107187 (CVSS 8.5): the getDataRecords workflow can read any Archibus-managed table. Rapid7 pulled user names, passwords, emails and roles from the afm_users table, including system administrator accounts. It notes that authenticated users may be able to reach this workflow without the bypass, but did not test that.
Rapid7 published full request and response examples for each step, so defenders should assume the chain is now straightforward to reproduce.
A disclosure that took months of chasing
Rapid7's timeline shows it first contacted Eptura on July 2 and followed up repeatedly through August and September before the vendor engaged on the report. On October 9, Eptura clarified the affected versions, said a fix was in development for version 2025.01, and asked for a one-week extension, which moved publication to October 19.
Upgrade to Archibus 2025.02 or later
Rapid7's advice is to update to Archibus 2025.02 or higher, where the vulnerable DWR method used for the bypass was moved to a REST API. Customers download the installer from their Eptura account. Administrators of any instance that was reachable before upgrading can look for unexpected .jspx files named DataViewReport plus a timestamp under the per-site exportReports folder, the location Rapid7's proof of concept wrote to, and should treat credentials stored in Archibus as potentially exposed. Rapid7 says checks for its own vulnerability management products are expected in its October 21 content release.
Facilities software rarely gets the scrutiny given to email gateways or VPNs, yet this platform holds a map of the estate and a list of everyone who can log in to it. Rapid7's team has been busy this month: it also turned a perfect-10 GitLab bug into a working exploit.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.