CVE-2026-107186
Received Received - Intake

Unauthenticated Workflow Rule Execution in Rapid7 InsightVM

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Rapid7, Inc.

Description
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-107186
EUVD
EUVD-2026-104458

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eptura Archibus 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated user to bypass authentication by sending a DWR request with isPasswordUppercase as one call method and then setting the next call method to run a workflow rule. This enables execution of workflow rules without credentials.

Detection Guidance

Monitor network traffic for suspicious DWR requests to legacy API endpoints. Check server logs for unauthenticated workflow rule executions or unusual session activity. Inspect HTTP requests containing 'isPasswordUppercase' or similar parameters.

Impact Analysis

An attacker could exploit this to run unauthorized workflow rules, potentially accessing sensitive data like usernames and passwords stored in the afm_users table. This could lead to further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA, which mandate strict access controls and protection of personal information.

Mitigation Strategies

Apply the latest patches from Eptura Archibus immediately. Disable or restrict access to the vulnerable DWR API endpoint. Implement network-level controls to block unauthorized HTTP requests to the affected endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107186. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart