Eptura has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 8.6 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-107188Critical· 9.6Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution53CVE-2026-107187High· 8.5Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables47CVE-2026-107186High· 8.6Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse47
Eptura vulnerabilities
CVEs affecting Eptura, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-107186High· 8.6Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
CVE-2026-107187High· 8.5Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads wit…
CVE-2026-107188Critical· 9.6Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authen…