{"id":"CVE-2026-107186","published":"2026-10-19T17:17:00.827","lastModified":"2026-10-19T21:14:14.150","description":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}