Eptura Archibus Users Face Critical RCE Risk Before 2025.02 Update

Eptura Archibus installations running versions prior to 2025.02 are exposed to a critical remote code execution vulnerability. The National Vulnerability Database assigns CVE-2026-107188 to this flaw, rating it 9.6 on the Common Vulnerability Scoring System.

What happened

The National Vulnerability Database describes a flaw allowing users to upload export reports containing arbitrary file contents. Attackers can specify JSPX as the file extension, enabling the server to process executable Java Server Pages. The NVD record notes that anyone can browse to these uploaded files, leading to command execution on the system.

This upload capability can be chained with a separate authentication bypass vulnerability. This combination allows an attacker to run code on the server without providing valid credentials. The underlying weakness is classified as CWE-434, which relates to unrestricted upload of executable code.

Why it matters

A CVSS score of 9.6 indicates a critical severity level for this vulnerability. The ability to execute commands remotely without authentication poses a severe risk to system integrity. Organizations using Eptura Archibus for facilities management must assess their exposure immediately.

As Patch Gazette reported on 2026-10-19, similar unauthenticated remote code execution flaws have plagued other infrastructure software. The Broadcom SDK WPS flaw allowed attackers to compromise routers without passwords, highlighting the persistent danger of unauthenticated access vectors.

What to watch

• Verify the exact version of Eptura Archibus currently deployed in your environment.
• Check for any pending updates or patches from Eptura for versions prior to 2025.02.
• Monitor network logs for unusual file upload activity or requests for JSPX files.
• Review access controls to ensure the authentication bypass component is not exploitable.

Who needs to act first

Teams should prioritize systems exposed to the internet or untrusted networks. Begin by identifying all instances of Eptura Archibus running versions before 2025.02. Isolate high-risk servers from general network access while testing for the vulnerability. Create full backups of application data before attempting any configuration changes. If a patch is not yet available, implement strict input validation on upload endpoints to block executable file types.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Eptura Archibus

• Audit your Eptura Archibus installations to confirm if any run versions prior to 2025.02.
• Restrict access to upload functionality to trusted internal networks until a fix is confirmed.
• Monitor server logs for unexpected file creation or execution of JSP and JSPX files.
• Prepare to apply the vendor update once Eptura releases a patch for CVE-2026-107188.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Eptura Archibus are affected by CVE-2026-107188?

All versions of Eptura Archibus prior to 2025.02 are affected by this critical vulnerability.

Can attackers exploit this flaw without logging in?

Yes, the NVD states the authentication bypass vulnerability can be chained to run code without authentication.

What is the severity rating for this vulnerability?

The National Vulnerability Database rates CVE-2026-107188 as 9.6, which is classified as critical.