type: cve · created: 2026-10-20 · updated: 2026-10-20 · tags: [cve] · confidence: medium · severity: high · affected_sectors: [global] · au_impact: false
CVE-2026-107186 (CVSS 8.6) abuses Archibus Web Central's Java Direct Web Remoting endpoint: the pre-authentication isPasswordUppercase method loads a core user session onto the thread, and a second batched call to runWorkflowRule then runs workflow rules under that session with no credentials.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-107186 |
| CVSS | 8.6 (HIGH) |
| Vendor / product | Not stated |
| Reported | 2026-10-20 |