Rapid7 has published three chained vulnerabilities in Eptura Archibus, the workplace and real-estate management platform that tracks assets, maintenance work orders, leases and desk or room reservations, and which Eptura says was used by more than 16,000 companies and 40% of the Fortune 500 as of 2023. CVE-2026-107186 (CVSS 8.6) abuses Archibus Web Central's Java Direct Web Remoting endpoint: the pre-authentication isPasswordUppercase method loads a core user session onto the thread, and a second batched call to runWorkflowRule then runs workflow rules under that session with no credentials. Chained with it, CVE-2026-107187 (CVSS 8.5) reads arbitrary database tables through the AbCommonResources-getDataRecords workflow — Rapid7 extracted user names and passwords from the afm_users table — while CVE-2026-107188 (CVSS 9.6, critical) allows JSP/JSPX uploads via export reports, yielding command execution as NT AUTHORITY\Local Service. Rapid7 found the flaws through continuous red teaming and says all three are fixed, and CISA's SSVC record lists no known exploitation. Why it matters: facility and property teams run Archibus inside corporate networks, so an internet-facing instance is a direct path to stored credentials and code execution on a building-management platform.

• Source article