Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)
From the source: Rapid7 Blog
Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus . A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication ( CVSS: 8.6 High ). The most serious functions allow for full database read ( CVSS: 8.5 High ) and an insecure file…
Read the full story on Rapid7 BlogAsk the square
The story is what was announced. If it raises a question for your team, ask the people who run this technology day to day. Your post links back to this story, so the next reader finds it too.
Recent threads in Security
Which security investments are you prioritising for FY27?
Identity, cloud security posture, AI security, SOC automation, resilience? Share your top two and why.
How are you securing employee use of generative AI tools?
Blocking, allow-listing, DLP, enterprise licences, policy and training: what combination is working in practice?
Something wrong or out of date? Suggest a correction. We reply within 5 business days.
More from Rapid7
Recent updates from Rapid7, so you can tell whether this is a one-off or part of a pattern.
More in Security
What other companies in Security are doing. The category page shows who’s active, side by side.
