Is CVE-2026-107186 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107186 being exploited in the wild.

How severe is CVE-2026-107186?

High severity, with a CVSS score of 8.6, published 19 October 2026.

Is there a fix for CVE-2026-107186?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107186 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107186?

Check whether you run Eptura Archibus. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107186: Eptura Archibus authentication bypass via DWR

CVE-2026-107186 · Severity: high · CVSS 8.6 · Published 2026-10-19

Eptura Archibus is a facility management platform used by over 40% of Fortune 500 companies to manage buildings, equipment, and real estate. An unauthenticated attacker can exploit a legacy API endpoint to bypass authentication and execute arbitrary workflow rules, read entire databases, upload malicious files, and ultimately execute system commands as the service account to fully compromise the server.

Technologies: Eptura Archibus. Vendors: Eptura.

Quick answers

Is CVE-2026-107186 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107186 being exploited in the wild.
How severe is CVE-2026-107186?: High severity, with a CVSS score of 8.6, published 19 October 2026.
Which products and versions are affected?: Eptura Archibus.
Is there a fix for CVE-2026-107186?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107186 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107186?: Check whether you run Eptura Archibus. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Java Direct Web Remoting (DWR) API allows multiple method calls in a single request. The whitelisted isPasswordUppercase method sets a privileged core user session on the thread-local context store, and the subsequent runWorkflowRule method reuses this authenticated session without re-validating credentials. An attacker can chain these calls to run any workflow rule, access database records, or upload files without providing credentials.

Affected products

Eptura Archibus

Timeline

2026-10-19: disclosed

References

https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.