Rapid7 Critical Vulnerabilities Found in Eptura Archibus Software
Article Content
- •Three critical vulnerabilities found in Eptura Archibus software.
- •CVE-2026-107188 has a CVSS score of 9.6, indicating critical severity.
- •Patches for all vulnerabilities were released on October 19, 2026.
Rapid7 identified three significant vulnerabilities in Eptura Archibus, a software used by over 16,000 organizations, including 40% of the Fortune 500. The vulnerabilities include an authentication bypass (CVE-2026-107186, CVSS 8.6), a full database read capability (CVE-2026-107187, CVSS 8.5), and an insecure file upload leading to remote code execution (CVE-2026-107188, CVSS 9.6). Attackers with network access can exploit these flaws to read sensitive information and execute arbitrary code on the server. Rapid7 disclosed these vulnerabilities on October 19, 2026, and they have been patched. The vulnerabilities were discovered during continuous red teaming exercises by Marcus Chang, a Security Consultant at Rapid7.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (1)
Following this threat?
Track Archibus and CVE-2026-107186 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What are the CVEs associated with these vulnerabilities?
What should organizations do to protect themselves?
Is there any evidence of active exploitation?
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…