Archibus CVE-2026-107187 Exposes Database Credentials via Data Leak Flaw
A high-severity vulnerability in Eptura Archibus allows unauthenticated users to extract database credentials through a specific workflow request mechanism.
Key points
- CVE-2026-107187 affects Eptura Archibus versions prior to 2025.02.
- Attackers can bypass authentication to read database usernames and passwords.
- Database write and delete operations may be possible but remain untested.
Eptura Archibus contains a high-severity flaw that permits unauthorised access to sensitive database details. This vulnerability, identified as CVE-2026-107187, affects all versions of the software released before the 2025.02 update, leaving many installations exposed to credential theft.
What happened
The National Vulnerability Database records that a user can access any database details, including usernames and passwords, by sending a specific DWR request with a specified workflow rule. This issue is classified under CWE-200, indicating an information exposure weakness. The flaw allows an attacker to bypass standard authentication controls entirely, granting them direct visibility into the underlying database configuration and stored credentials.
Why it matters
The severity of this issue is rated as high, with a CVSS score of 8.5, according to the NVD record. The vulnerability can be chained with an existing authentication bypass flaw to perform database reads without any form of authentication. While the primary impact is data leakage, the source material notes that database write and delete operations may also be possible, though these specific actions were not tested during the initial assessment.
Next steps
- Identify all installations running Eptura Archibus versions older than 2025.02.
- Monitor network traffic for unusual DWR requests associated with workflow rules.
- Restrict network access to the application to limit exposure to untrusted sources.
- Prepare to apply the 2025.02 update once it is confirmed to address this specific CVE.
Detection notes
Security teams usually monitor for anomalous data retrieval patterns that deviate from standard user behaviour. Analysts should check whether web application logs show DWR requests originating from unauthenticated sessions or unusual IP addresses. Look for repeated attempts to access workflow rule endpoints that return large volumes of structured data. Containment moves typically involve isolating the affected application from the broader network to prevent further credential exfiltration while investigating the scope of the breach.
What to do and how to stay safe: Eptura Archibus
- Audit current Archibus installations to determine if they are running versions prior to 2025.02.
- Review web server logs for unauthorised DWR requests targeting workflow rule endpoints.
- Implement network segmentation to restrict access to the database layer from the application tier.
- Wait for the vendor to provide an official update before attempting manual workarounds.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Archibus are affected by CVE-2026-107187?
The vulnerability affects Eptura Archibus versions prior to 2025.02.
Can attackers modify or delete data through this flaw?
Database write and delete operations may be possible, but this was untested.
What is the severity rating for this vulnerability?
The NVD rates the severity as high, with a CVSS score of 8.5.
