Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)

Reported by Rapid7 (Marcus Chang)

Summary by Cyber Security News19 Oct 2026, 17:57 CET

About this summary. This is a short excerpt from the description that Rapid7 published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed

OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical).

Read the full article at Rapid7 →

Source attribution: headline and facts are from Rapid7 (rapid7.com). Summary method: excerpt of the source description. See our source attribution policy.