CVE-2026-107186
8.6HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-287
Impact
Unauthenticated attackers over the network can execute workflow rules on the server. They only need network access to send a crafted Direct Web Remoting (DWR) request.
Root cause
An authentication bypass flaw lets unauthenticated DWR requests chain the 'isPasswordUppercase' method before a target workflow rule method to execute it unauthorized.
Affected systems
Eptura Archibus (exact affected versions not listed in CVE text — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade to the patched version of Eptura Archibus referenced in the vendor advisory, or restrict network access to the Archibus web interface to trusted IPs until updated.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.